CRISC Certified in Risk and Information Systems ControlInformation Technology and SecurityHard
A multinational corporation is undergoing a major digital transformation, migrating critical business applications and data to a public cloud environment. The Chief Risk Officer (CRO) is concerned about the inherent risks associated with cloud adoption, particularly vendor lock-in, data residency, and compliance with various international regulations. Which of the following frameworks would provide the MOST comprehensive guidance for managing these specific cloud-related risks?
- ANIST CSF (Cybersecurity Framework)
- BISO/IEC 27001
- CCOBIT 2019
- DCSA CCM (Cloud Controls Matrix)
Show answer & explanationAnswer & explanation
Correct answer: D. CSA CCM (Cloud Controls Matrix)
While COBIT, ISO 27001, and NIST CSF are all valuable for general information security and governance, the CSA Cloud Controls Matrix (CCM) is specifically designed to address the unique security and compliance challenges of cloud computing, making it the most comprehensive for cloud-related risks like vendor lock-in, data residency, and cloud-specific regulatory compliance.
Why the other options are wrong
- A. NIST CSF is a framework for improving critical infrastructure cybersecurity, offering a high-level approach but lacking the detailed cloud-specific controls of CCM.
- B. ISO/IEC 27001 is a standard for Information Security Management Systems (ISMS) and is broad, but less cloud-specific than CCM.
- C. COBIT 2019 provides a comprehensive governance framework but is not specialized for cloud risks.
CSA Cloud Controls Matrix (CCM)
A cybersecurity control framework from the Cloud Security Alliance (CSA) that lists security controls and compliance requirements specific to cloud computing, guiding cloud consumers and providers.
- Developed by the Cloud Security Alliance (CSA).
- Provides a common framework for cloud security controls.
- Maps to various other standards and regulations (e.g., ISO 27001, NIST, GDPR).
Memory trick: CSA CCM is the Cloud Control Master.