Governance, Risk, Compliance, Ethics and Sustainability

Introduction and Context

Cloud computing changes not only where computing resources are located but also how authority, accountability, risk and social responsibility are organized. In a traditional data centre, one organization commonly owns the facilities, hardware, operating systems and information. In cloud environments, responsibility is distributed among cloud service providers (CSPs), customers, software vendors, managed service providers, regulators and sometimes data subjects themselves. This distribution creates substantial benefits—elasticity, global reach and rapid innovation—but it also creates governance problems that cannot be solved by technical security controls alone.

Cloud governance is the system by which an organization directs, controls and evaluates its use of cloud services. It connects business strategy with architecture, procurement, security, privacy, resilience, legal obligations, financial management, ethics and sustainability. Effective governance does not mean eliminating all risk. It means making risk visible, assigning ownership, selecting proportionate controls and ensuring that decisions remain accountable over time.

This chapter examines governance through complementary perspectives: NIST provides risk-management and cybersecurity guidance; ISO standards provide internationally recognized management-system and cloud-control practices; the Cloud Security Alliance (CSA) provides cloud-specific control mappings; COBIT connects information and technology governance with enterprise objectives; and ITIL contributes service-management practices. These frameworks should be aligned rather than treated as competing checklists.

Learning Objectives

After completing this chapter, a student should be able to:

1. Explain the meaning and scope of cloud governance, risk, compliance and accountability.

2. Apply NIST, ISO, CSA, COBIT and ITIL concepts to cloud decisions.

3. Analyze shared responsibility, auditability, privacy and data-residency issues.

4. Design a proportionate control and assurance approach.

5. Evaluate ethical, accessibility and sustainability implications of cloud adoption.

6. Make and justify accountable cloud decisions using evidence, metrics and stakeholder analysis.

1. Governance as an Organizational Capability

Governance answers questions such as: What outcomes are sought? Who has authority? What risks are acceptable? How is performance measured? Who is accountable when an outcome fails? Management, by contrast, plans and operates within the direction established by governance. A cloud governance board may establish policy, while platform engineering and service owners implement and operate the resulting controls.

Important governance principles include:

• Value realization: cloud expenditure and architectural choices should support measurable organizational outcomes.
• Accountability: every important decision should have an identifiable owner, including decisions delegated to a provider.
• Risk proportionality: controls should reflect information sensitivity, threat exposure, legal duties and business impact.
• Transparency: assumptions, limitations, incidents and provider dependencies should be documented.
• Separation of duties: no single person should be able to request, approve, implement and conceal a high-risk change.
• Continuous oversight: cloud environments change rapidly; approval at procurement is not sufficient.

A practical governance operating model normally includes an executive sponsor, a cloud centre of excellence or architecture function, security and privacy officers, procurement and legal representatives, finance, service owners, platform operations and internal audit. The model should define decision rights through a responsibility assignment matrix. “The provider is responsible” is not an adequate assignment: the customer remains accountable for determining whether the provider’s service satisfies its obligations.

Governance domains

A mature program commonly governs:

1. Strategy and portfolio: selection of cloud models, sourcing strategy and business outcomes.

2. Architecture: approved patterns, identity design, network segmentation, resilience and portability.

3. Security and privacy: classification, access control, encryption, monitoring, incident response and privacy engineering.

4. Service management: availability, capacity, continuity, changes, configuration and supplier management.

5. Financial management: budgets, tagging, forecasting, cost allocation and avoidance of waste.

6. Compliance and assurance: obligations, evidence, audits, exceptions and remediation.

7. Data and records: ownership, retention, deletion, residency, transfer and lawful use.

8. Sustainability and ethics: energy, emissions, accessibility, human impact and responsible automation.

2. Shared Responsibility and Accountability

Cloud responsibility varies by service model. In infrastructure as a service (IaaS), the provider normally operates facilities, physical hosts and core networking, while the customer configures operating systems, applications, identities, data and much of the network policy. In platform as a service (PaaS), the provider operates more of the runtime and operating system. In software as a service (SaaS), the provider operates the application stack, but the customer remains responsible for appropriate users, data, configuration, lawful processing and business use.

The exact boundary is service-specific and must be verified in contractual and technical documentation. A responsibility matrix should cover at least:

• physical security and environmental controls;
• hypervisor and managed-service components;
• operating systems and application code;
• identity and privileged access;
• data classification, encryption and key management;
• vulnerability and patch management;
• logging, detection and incident response;
• backup, restoration and exit;
• privacy, retention and deletion;
• regulatory evidence and subcontractors.

The matrix should distinguish responsible (performs work), accountable (owns the result), consulted and informed parties. It should also identify assumptions. For example, a provider may offer immutable backups, but the customer may still need to select retention periods, test restoration and ensure that backups are legally permissible.

3. Integrating Major Frameworks

NIST

The NIST Cybersecurity Framework 2.0 organizes cybersecurity outcomes into Govern, Identify, Protect, Detect, Respond and Recover. Govern is especially significant because it establishes organizational context, risk strategy, roles, policies and oversight. The framework is outcome-oriented: it does not prescribe one technology or certification. NIST SP 800-37 describes a risk management framework with activities including prepare, categorize, select, implement, assess, authorize and monitor. NIST SP 800-53 provides a catalog of security and privacy controls, while NIST SP 800-61 addresses incident response. These publications can support system categorization, control selection and continuous monitoring.

NIST is valuable when an organization needs a structured risk process and traceability from mission objectives to controls and evidence. Its limitation is that organizations must adapt the guidance to local law, sector rules and provider capabilities.

ISO/IEC

ISO/IEC 27001 specifies requirements for an information security management system (ISMS), including organizational context, leadership, planning, support, operation, performance evaluation and improvement. It is management-system oriented and can support independent certification. ISO/IEC 27002 provides control guidance. ISO/IEC 27017 adds cloud-specific control guidance for providers and customers, and ISO/IEC 27018 addresses protection of personally identifiable information in public clouds. ISO/IEC 27701 extends privacy management through a privacy information management system.

ISO standards are useful for policy discipline, auditability and international supplier assurance. Certification applies to a defined scope, not automatically to every service or process of an organization. Students should therefore examine the certificate scope, statement of applicability, exclusions and assurance period rather than treating a certificate as proof of absolute security.

Cloud Security Alliance

The CSA Cloud Controls Matrix (CCM) is a cloud-focused control framework covering domains such as governance, risk, compliance, data security, identity and access management, application security, infrastructure and virtualization, interoperability and resilience. Its mappings to other standards assist organizations in crosswalking requirements and evaluating provider evidence. The CSA Consensus Assessments Initiative Questionnaire can help structure supplier due diligence, although a questionnaire is only one source of evidence.

COBIT

COBIT is an enterprise governance and management framework for information and technology. It distinguishes governance activities—evaluate, direct and monitor—from management activities—plan, build, run and monitor. COBIT’s governance and management objectives can connect cloud controls to enterprise goals, performance measures, capability assessment and accountability. It is particularly useful for boards and audit committees that require a business-oriented view rather than a purely technical control list.

ITIL

ITIL practices support the operational governance of cloud-enabled services. Relevant practices include incident management, problem management, change enablement, service configuration management, service continuity management, information security management, supplier management, monitoring and event management, and service-level management. ITIL does not replace cybersecurity or privacy controls; it helps embed those controls in repeatable service processes.

A practical integration method

An organization can integrate these frameworks in five steps:

1. Define business objectives, legal obligations, risk appetite and service scope.

2. Use COBIT to establish governance objectives, decision rights and performance oversight.

3. Use NIST or ISO 27001 to establish the risk and management-system process.

4. Use CSA CCM and ISO 27017 to interpret cloud-specific controls and provider responsibilities.

5. Use ITIL practices to operate, measure and improve services.

A control crosswalk should identify the control objective, owner, implementation location, evidence, testing frequency, exception process and mapped framework references. Mapping the same control to several frameworks reduces duplication, but it does not prove that the control is effective.

4. Risk Management in Cloud Environments

Cloud risk is the effect of uncertainty on objectives. Risk assessment should consider threats, vulnerabilities, exposure, likelihood, impact and existing controls. Important cloud risk categories include:

• unauthorized access caused by weak identities or exposed credentials;
• misconfiguration of storage, networks or security groups;
• provider or region outage;
• concentration risk and dependence on a dominant supplier;
• insecure interfaces and software supply chains;
• data loss, unlawful disclosure or inadequate deletion;
• inadequate logging or inability to obtain evidence;
• regulatory change and cross-border transfer restrictions;
• cost escalation and uncontrolled consumption;
• algorithmic discrimination or unsafe automation;
• environmental and social impacts.

A useful qualitative risk register records the asset or process, threat scenario, affected stakeholders, inherent risk, existing controls, residual risk, owner, treatment decision and due date. Treatment options are usually avoid, reduce, transfer or accept. Transfer through a contract or insurance does not remove the underlying business or ethical responsibility.

For quantitative analysis, annual loss expectancy is sometimes represented as:

ALE = SLE × ARO

where SLE is single-loss expectancy, expressed in monetary units for one event, and ARO is annual rate of occurrence, expressed as expected events per year. This model assumes that loss estimates and event frequency are meaningful and that monetary aggregation is appropriate. It is a decision aid, not a precise prediction. In cloud practice, scenario ranges and sensitivity analysis are often more credible than a single number. For example, if a modeled event would cost $120,000 and is estimated to occur 0.25 times per year, the modeled ALE is $30,000 per year. The estimate should be revisited when architecture, threat intelligence or business impact changes.

Risk acceptance should be explicit, time-limited and approved by an authority with sufficient organizational responsibility. Exceptions should identify compensating controls and review dates.

5. Compliance, Auditability and Assurance

Compliance means meeting applicable obligations, which may arise from legislation, regulation, contracts, industry standards, internal policy or ethical commitments. A cloud compliance program begins with an obligation register. Each obligation should be translated into control objectives, assigned an owner and linked to evidence.

Auditability requires more than retaining documents. Evidence should be reliable, attributable, complete, protected from alteration and available for the required period. Typical cloud evidence includes identity and access reviews, configuration baselines, vulnerability results, change records, incident tickets, backup-restoration tests, provider attestations, data-flow diagrams, privacy assessments and training records. Automated evidence collection from cloud APIs can improve timeliness, but automation itself requires validation and access control.

Provider assurance may include independent audit reports, certifications, penetration-test summaries, service-level reports and contractual audit rights. Customers should ask:

• What services and regions are in scope?
• Which controls are provider-operated and which are customer-configured?
• Are complementary customer controls clearly stated?
• How are subcontractors governed?
• What notification and cooperation rights exist during incidents?
• Can evidence be obtained in a usable form?
• What happens at termination, including data return and secure deletion?

A right to audit that is operationally impossible, prohibitively expensive or limited to a generic report may provide less assurance than expected. Continuous control monitoring, independent testing and management review should supplement formal audits.

6. Privacy, Data Residency and Data Sovereignty

Privacy governance addresses how personal data is collected, used, disclosed, retained and deleted. Core principles commonly include purpose limitation, data minimization, accuracy, storage limitation, security, transparency and accountability. The applicable legal interpretation depends on jurisdiction, sector and the roles of controller, processor or equivalent parties.

A privacy impact assessment should document data categories, individuals affected, purposes, lawful basis where applicable, data flows, recipients, international transfers, retention, risks and mitigations. Privacy by design may involve tokenization, pseudonymization, field-level encryption, access minimization, differential disclosure controls and privacy-preserving analytics. Encryption is not a complete privacy solution: keys, metadata, logs, backups, support access and application behavior must also be considered.

Data residency usually refers to the physical or logical location in which data is stored or processed. Data sovereignty refers more broadly to the legal authority and jurisdiction that may apply to data, provider entities and access requests. A residency requirement may not be satisfied merely by selecting a local storage region if support personnel, telemetry, backups or subprocessors operate elsewhere. Contracts and architecture should address:

• primary and backup locations;
• administrative and support access;
• subprocessors and government requests;
• encryption-key location and control;
• replication and disaster recovery;
• deletion verification;
• legal transfer mechanisms;
• data portability and exit.

Data classification should drive location and control decisions. Highly sensitive data may require dedicated keys, restricted regions, customer-managed access, confidential-computing techniques or a non-cloud alternative. Conversely, imposing residency constraints on low-risk data can create unnecessary cost and reduce resilience.

7. Ethics, Responsible Use and Accessibility

Legal compliance is a minimum, not a complete ethical standard. Ethical cloud decision-making considers affected people, power asymmetries, foreseeable misuse, distribution of benefits and harms, and the organization’s ability to explain and remedy outcomes.

Responsible use of cloud-based AI requires attention to data provenance, consent, bias, explainability, security, human oversight, model drift and contestability. A system that automatically denies a benefit or ranks applicants should have documented purpose, validation, monitoring, appeal channels and a human authority able to intervene. Providers’ claims about “responsible AI” should be assessed through evidence, not branding.

Accessibility is both a legal and ethical concern. Cloud-hosted applications should conform to applicable accessibility requirements, such as recognized web accessibility standards, and should be tested with assistive technologies and users with disabilities. Accessibility includes authentication, error messages, dashboards, support channels, downloadable records and incident communications. A security control that makes a service unusable for a disabled user is not a complete control design; security and accessibility must be engineered together.

Ethical review should include stakeholder consultation, impact assessment, documentation of rejected alternatives and a mechanism for complaints and remediation. Procurement should avoid transferring unacceptable harm to workers, communities or vulnerable populations merely because a supplier operates in another jurisdiction.

8. Sustainability and Carbon-Aware Cloud Governance

Cloud sustainability includes energy use, greenhouse-gas emissions, water consumption, hardware life cycles, e-waste and the social effects of data-centre construction and operation. Cloud migration does not automatically reduce environmental impact. A poorly optimized, always-on workload can consume more resources than an efficient local deployment.

Governance should measure meaningful activity, such as workload execution, storage volume, data transfer and service utilization, rather than relying only on total provider claims. Important practices include rightsizing, autoscaling, shutting down idle non-production resources, efficient architectures, storage lifecycle policies, workload scheduling, lower-carbon regions where legally and operationally appropriate, efficient data formats, and reducing unnecessary data movement. Sustainability decisions must not undermine availability, privacy, accessibility or regulatory obligations.

Carbon accounting is difficult because providers differ in methodology, boundary, renewable-energy claims, allocation methods and treatment of embodied emissions. Therefore, metrics should state their scope and assumptions. Useful indicators may include resource utilization, idle-resource percentage, energy or emissions estimates per transaction, storage growth, data-transfer volume and percentage of workloads with sustainability objectives. These are management indicators, not universally comparable physical measurements unless their boundaries are standardized.

Sustainable procurement should request evidence about energy efficiency, renewable-energy sourcing, water stewardship, hardware reuse, e-waste and supply-chain labor practices. A credible target includes a baseline, measurement method, responsible owner, time horizon and review process.

9. Decision Rights and the Cloud Lifecycle

Governance should operate across the lifecycle:

1. Explore: identify objectives, stakeholders, data classes, risks and alternatives.

2. Design: select architecture, controls, regions, providers, service levels and exit options.

3. Acquire: assess suppliers, negotiate responsibilities, evidence access, privacy terms and subcontracting.

4. Build and migrate: test security, resilience, accessibility, performance, data quality and rollback.

5. Operate: monitor controls, cost, incidents, service levels, privacy events and sustainability indicators.

6. Change: apply risk-based change enablement and reassess dependencies.

7. Exit: return or securely delete data, revoke access, preserve required records and validate termination.

Decision records should explain alternatives, assumptions, evidence, residual risks, approvals and review triggers. This creates institutional memory and makes later audits and incident investigations more reliable.

Illustrative Case: A Regional Health Analytics Platform

Background

A fictional public-health agency, Meridian Health Authority (MHA), proposes a cloud platform to analyze pseudonymized patient data from hospitals. The platform will support disease surveillance and resource planning. It requires elastic analytics, controlled collaboration and rapid disaster recovery.

Problem

The initial proposal selected a global public-cloud service without specifying backup locations, support access, retention, model-governance procedures or accessibility requirements. The security team focused on perimeter controls, while the legal team was concerned about cross-border processing. Finance also identified unpredictable data-transfer costs.

Analysis

MHA classified direct identifiers as highly restricted and pseudonymized analytical data as sensitive. A data-flow analysis showed that primary data would be stored in one approved region, but support logs and operational telemetry could be processed elsewhere. The risk assessment identified re-identification, privileged misuse, provider outage, unlawful transfer, model bias and excessive retention. The sustainability assessment found that an always-on cluster was unnecessary for periodic workloads.

Using NIST, MHA established governance ownership, categorization, control selection and continuous monitoring. ISO/IEC 27001 and 27701 practices were used for the ISMS and privacy management. CSA CCM and ISO/IEC 27017 informed provider and customer cloud controls. COBIT aligned the investment with public-health objectives and clarified board oversight. ITIL practices defined incident, change, configuration, continuity and supplier management.

Approach and solution

MHA required regional storage and documented all support and subprocessors. Customer-controlled keys were used for the most sensitive datasets. Access was federated, strongly authenticated, role-based and reviewed periodically; privileged actions were logged and monitored. Pseudonymization keys were held separately, and re-identification required approved procedures. Retention and deletion schedules were automated and tested.

The contract included breach notification, evidence access, cooperation with regulators, restoration objectives, subcontractor disclosure, portability and secure deletion. MHA conducted restoration and exit tests rather than relying on contract language. The analytics service was scheduled for workload demand, with lifecycle policies for intermediate data. Accessibility testing covered dashboards and exported reports. Any predictive model required documented validation, bias assessment, human review and an appeals process before operational use.

Outcome

The platform was approved with conditions: quarterly risk review, annual independent assurance, regular access recertification, tested recovery, cost and sustainability reporting, and a formal review before processing new data categories. MHA accepted residual provider-concentration risk temporarily while funding a portability design.

Learning points

The case demonstrates that cloud governance is a socio-technical capability. Security, privacy, procurement, service management, ethics, finance and sustainability must be considered together. A provider certificate supports assurance but does not replace customer governance. Most importantly, accountability remained with MHA even when operational tasks were delegated.

Challenges and Limitations

Framework integration can produce excessive documentation, duplicated controls and false confidence. A control may exist on paper but fail in operation. Provider transparency may be limited, especially for proprietary services and nested subprocessors. Multi-jurisdictional law can be uncertain, and data-residency claims may not address remote access or metadata. Quantitative risk and carbon estimates can imply more precision than the evidence supports. Sustainability improvements can conflict with latency, resilience or sovereignty. Finally, governance can become a barrier to innovation if every decision receives the same approval burden.

A proportionate approach addresses these limitations through risk-tiered controls, reusable patterns, automated guardrails, clear exception processes, independent challenge and periodic outcome review. Governance should enable safe innovation, not merely document prohibition.

Contemporary Developments and Best Practices

Current practice increasingly emphasizes continuous authorization, infrastructure as code, policy as code, software supply-chain assurance, confidential computing, zero-trust architectures, sovereign-cloud offerings, FinOps and GreenOps. These techniques are valuable when their claims are tested. Automated policy enforcement should include exception handling and human review; continuous authorization should not become continuous surveillance; and AI-assisted compliance should preserve traceability and prevent fabricated evidence.

Best practices include:

• maintain a service catalogue and data-flow inventory;
• classify workloads and apply risk-tiered landing zones;
• define shared responsibility in technical and contractual terms;
• use strong identity, least privilege and separation of duties;
• collect tamper-resistant, time-synchronized evidence;
• test restoration, incident response and provider exit;
• review certifications for scope and complementary controls;
• integrate privacy, accessibility, ethics and sustainability at design time;
• measure outcomes rather than counting policies;
• train decision-makers and publish accountable ownership;
• reassess risks when providers, regions, data, models or regulations change.

Chapter Summary

Cloud governance aligns cloud use with organizational objectives, legal duties, risk appetite and social responsibility. Shared responsibility does not eliminate customer accountability. NIST supports cybersecurity risk management; ISO/IEC standards support management systems, cloud controls and privacy; CSA provides cloud-specific control structure; COBIT connects governance with enterprise objectives; and ITIL embeds controls in service operations. Effective programs maintain obligation registers, evidence, risk decisions, provider assurance and lifecycle controls. Privacy requires attention to data flows, residency, sovereignty, subprocessors, keys and deletion. Ethical governance extends beyond compliance to responsible AI, accessibility, stakeholder impact and remedy. Sustainability requires measured, transparent and workload-aware action rather than assumptions about cloud efficiency. Mature governance is continuous, evidence-based, proportionate and capable of balancing security, resilience, innovation, cost, privacy, ethics and environmental responsibility.

Key Terms

Cloud governance: Direction, control and oversight of cloud use to achieve objectives responsibly.

Shared responsibility: Allocation of operational security and compliance duties between provider and customer.

Accountability: Obligation to own decisions and outcomes, even when work is delegated.

Risk appetite: The level and type of risk an organization is willing to pursue or retain.

Residual risk: Risk remaining after controls and treatments are applied.

NIST CSF: A cybersecurity framework organized around Govern, Identify, Protect, Detect, Respond and Recover.

ISO/IEC 27001: Requirements for an information security management system.

ISO/IEC 27017: Cloud-specific security control guidance.

CSA CCM: A cloud-focused control matrix and assurance reference.

COBIT: A framework connecting enterprise governance and management of information and technology.

ITIL: A body of practices for managing and improving digital services.

Auditability: The ability to produce reliable evidence supporting compliance and control effectiveness.

Data residency: The location where data is stored or processed.

Data sovereignty: The legal authority and jurisdiction applicable to data and its processing.

Privacy by design: Integrating privacy protections into systems and processes from the outset.

Pseudonymization: Processing that separates identifying information so attribution requires additional information.

Responsible AI: Development and use of AI with attention to safety, fairness, transparency, accountability and human oversight.

GreenOps: Operational practices that reduce the environmental impact of digital services.

Control crosswalk: A mapping of equivalent or related requirements across frameworks.

Exit strategy: Planned methods for portability, termination, data return and secure deletion.

Review Questions

Short Answer Questions

1. What is the difference between cloud governance and cloud management?

2. Why does a provider’s security certification not eliminate customer accountability?

3. Define data residency and data sovereignty.

4. Name four types of evidence useful in a cloud audit.

5. What is the purpose of a responsibility assignment matrix?

Long Answer Questions

1. Compare the contributions of NIST, ISO/IEC, CSA, COBIT and ITIL to an integrated cloud governance program.

2. Explain how privacy, data residency and subcontractor access should be addressed in a cloud contract and architecture.

3. Discuss the relationship between risk acceptance, residual risk and continuous monitoring.

4. Evaluate the ethical and accessibility obligations of an organization deploying cloud-based AI.

5. Explain why cloud adoption does not automatically reduce environmental impact and propose a governance approach for sustainability.

Analytical / Application Questions

1. An organization stores regulated records in a local cloud region, but its provider’s support logs are processed globally. Analyze the governance, privacy and contractual issues and recommend controls.

2. Design a framework-aligned control approach for a SaaS application processing sensitive customer data. Identify owners, evidence and review activities.

3. A proposed analytics workload is inexpensive but runs continuously, has low utilization and creates substantial data transfer. Evaluate the decision using security, resilience, financial, sustainability and ethical criteria.

Multiple Choice Questions with Answers

Question 1

Which NIST Cybersecurity Framework 2.0 function establishes organizational context, risk strategy and oversight?

A. Govern

B. Protect

C. Detect

D. Recover

Correct Answer: A. Govern

Question 2

In a typical IaaS arrangement, which responsibility normally remains with the customer?

A. Physical security of the provider’s data centre

B. Replacement of failed provider-owned hardware

C. Configuration of customer identities and operating systems

D. Operation of the provider’s hypervisor

Correct Answer: C. Configuration of customer identities and operating systems

Question 3

What is the primary purpose of a control crosswalk?

A. To replace all audits with questionnaires

B. To map related requirements across frameworks

C. To calculate carbon emissions precisely

D. To eliminate the need for risk acceptance

Correct Answer: B. To map related requirements across frameworks

Question 4

A single loss is estimated at $120,000 and the annual rate of occurrence is 0.25. Using ALE = SLE × ARO, what is the modeled annual loss expectancy?

A. $4,800

B. $30,000

C. $120,000

D. $480,000

Correct Answer: B. $30,000

Question 5

Which statement best distinguishes data residency from data sovereignty?

A. Residency concerns location; sovereignty concerns applicable legal authority

B. Residency concerns encryption; sovereignty concerns availability

C. Residency applies only to paper records; sovereignty applies only to databases

D. They are always identical concepts

Correct Answer: A. Residency concerns location; sovereignty concerns applicable legal authority

Question 6

Which framework is primarily oriented toward enterprise governance and management of information and technology?

A. COBIT

B. CSA CCM

C. ITIL

D. ISO/IEC 27018

Correct Answer: A. COBIT

Question 7

Which is the strongest example of audit evidence?

A. A supplier’s marketing brochure

B. An unapproved verbal assurance

C. A time-stamped access-review record within defined scope

D. A general statement that the cloud is secure

Correct Answer: C. A time-stamped access-review record within defined scope

Question 8

Why is a cloud provider certificate insufficient by itself as proof of customer compliance?

A. Certificates never contain control information

B. Certification scope and complementary customer controls must be examined

C. Cloud providers cannot be audited

D. Customer organizations are exempt from compliance

Correct Answer: B. Certification scope and complementary customer controls must be examined

Question 9

Which practice most directly supports sustainable cloud operations?

A. Keeping all development resources permanently active

B. Increasing data replication without assessing need

C. Rightsizing workloads and shutting down idle resources

D. Disabling monitoring to reduce log volume

Correct Answer: C. Rightsizing workloads and shutting down idle resources

Question 10

Which principle is most important when deploying an automated system affecting access to public benefits?

A. Remove all human review to maximize speed

B. Provide validation, oversight, explanation and a remedy process

C. Conceal the model’s purpose from affected people

D. Use the largest possible dataset regardless of purpose

Correct Answer: B. Provide validation, oversight, explanation and a remedy process