Topics in this domain
- IT Governance vs. IT Management
- Board and Senior Management Roles
- IT Steering Committee
- IT Strategy and Business Alignment
- Balanced Scorecard
- COBIT
- ITIL
- ISO 27001/27002
- COSO: ERM and Internal Control
- Policies, Standards, Procedures, Guidelines
- IT Organizational Structure and Key Roles
- Segregation of Duties in IT
- Enterprise Architecture (Zachman, TOGAF)
- Risk Management Process
- Qualitative vs. Quantitative Risk Assessment
- Risk Responses: Mitigate, Transfer, Avoid, Accept
- Risk Appetite and Residual Risk
- Maturity Models (CMMI)
- KPIs and KGIs
- Outsourcing: Benefits and Risks
- Vendor Selection, Contracts, SLAs, Right to Audit
- Cloud and Offshore Governance
- Portfolio and Resource Management
- HR: Hiring, Training, Termination
- Legal and Regulatory Compliance
- Quality Management
Cloud and Offshore Governance
Renting instead of owning
Cloud computing is renting IT instead of owning it.
Like renting a home, the landlord looks after some things and you look after others, and the arguments start when nobody is sure who fixes what. IaaS is renting an empty flat: the building is theirs, everything inside is yours. PaaS is a furnished flat. SaaS is a hotel room: they handle almost everything, but you still decide who gets a key.
| Model | Provider manages | Customer manages |
|---|---|---|
| IaaS (infrastructure) | Buildings, hardware, virtualisation | Operating system, middleware, applications, data, access |
| PaaS (platform) | All of the above plus OS and runtime | Applications, data, access |
| SaaS (software) | Almost everything up to the application | Data, users and access, configuration |
Deployment models: public (shared infrastructure), private (one organisation), community (a group with shared needs), hybrid (a mix).
Who looks after what
Whatever the model, the customer stays responsible for:
- its data: classification, protection, retention
- users and access: who can log in and what they can do
- the configuration it controls
- compliance: regulators hold the customer accountable
Many cloud breaches come from the customer’s own mistakes, such as a storage bucket left open to the internet, not from the provider. The split of responsibilities should be written down so nothing falls between the two sides.
Cloud governance worries
- Data location: data in another country may be subject to its laws, including government access. Privacy laws may restrict moving personal data abroad.
- Assurance: large providers rarely let individual customers audit them. Assurance comes from SOC 2 reports, ISO 27001 (and 27017/27018) certificates, and CSA STAR. Check scope, period and the controls you’re expected to run yourself.
- Multi-tenancy: your data must be kept separate from other customers’.
- Availability: the provider’s SLAs, regional redundancy, and your own resilience design.
- Exit and portability: can you get your data back, in a usable format, in a reasonable time?
- Shadow IT: departments buying cloud services directly, skipping security and procurement. A cloud policy and discovery tools help.
Offshore outsourcing
Outsourcing to another country adds:
- different legal systems and difficulty enforcing contracts
- privacy rules on moving personal data abroad
- political, economic and natural disaster risk
- language, cultural and time zone differences
- difficulty doing on-site audits
Mitigations: contracts under home-country law, legal review of data transfers, country risk assessments, strong governance and communication routines, and independent assurance.
Example. The marketing team signs up for a cloud analytics tool on a credit card and uploads customer lists. The provider stores data in another region, and nobody checked its security. The finding is a governance gap: no cloud policy or approval process, and personal data moved abroad without anyone assessing the legal impact.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| What the customer is always responsible for in the cloud | Its data and access management |
| Main concern with data stored abroad | Jurisdiction and privacy law compliance |
| How to get assurance over a large cloud provider | Independent reports (SOC 2, ISO 27001), checked for scope |
| Risk of departments buying cloud services directly | Shadow IT bypassing governance and security review |
| Key thing to plan before choosing a cloud provider | Exit strategy and data portability |
In short
- IaaS, PaaS and SaaS shift different amounts of work to the provider, but the customer always owns its data, its users and their access.
- The shared responsibility split must be understood and written down; gaps appear where each side assumes the other is covering something.
- Where data is stored decides which laws apply, affecting privacy, government access and disputes.
- Assurance over large cloud providers usually comes from independent reports (SOC 2, ISO 27001, CSA STAR), not direct audits.
- Offshore outsourcing adds legal, political, language, time zone and audit-access risks.
- Plan exit and data portability from the start.
Exam traps
- Moving to the cloud doesn't transfer accountability for protecting data.
- In SaaS, the customer still manages user access and data classification.
- A provider's certificate must cover the services and regions you actually use.
- Data stored in another country may fall under that country's laws.
- Shadow IT (departments buying cloud services directly) bypasses governance.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Who looks after what