How to choose, configure and use cloud services securely.
Pages
Page 17 of 29
Principle 4: Governance framework
A governance framework is vital to co-ordinate and direct the management of the service.
An effective governance framework will ensure that procedural, personnel, physical and technical controls continue to work through the lifetime of a service. It should also respond to changes in the service, technological developments, and the appearance of new threats.
Goals
You should be confident that the service has a governance framework and processes which are appropriate for your intended use.
You should look for good governance practices, including:
A clearly identified, and named, board representative (or a person with the direct delegated authority) who is responsible for the security of the cloud service. This person will typically have the title ‘Chief Security Officer’, ‘Chief Information Officer’ or ‘Chief Technical Officer’.
A documented framework for security governance and risk management, with policies governing key aspects of information security, relevant to the service.
Security and information security are part of the service provider’s financial and operational risk reporting mechanisms, ensuring that the board will be kept informed of security and information risk.
Processes to identify and ensure compliance with applicable legal and regulatory requirements.
Suggested implementation approaches
There are some common security standards that include controls covering how well a governance framework risk-manages a particular service. These include CSA CCM v3.0.1, SOC2, and ISO/IEC 27001. Note that standards differ in the level of detail that they cover. You should seek evidence of independent certification against such standards and ensure that the scope covers the goals that are set out above.
Services subject to GDPR may be able to use evidence provided to demonstrate compliance with the accountability data protection principle for some of the points above. The service provider’s GDPR Data Protection Officer will sometimes be the board representative who is responsible for the security of the cloud service.
A service provider may instead assert that the 4 goals above are met, providing evidence of an independent audit of the claims made. As with all service provider assertions, you will need to decide whether you are content with the level of confidence this gives you.
