CCSK Legal, Compliance, and Audit in Cloud

Question 1

What does CCSK identify as the primary legal challenge of cloud computing related to data location?

Accepted Answer

Data may reside in multiple jurisdictions simultaneously, creating complex and potentially conflicting legal obligations

Answer

Cloud providers charge more for data stored in regulated jurisdictions

Answer

Cloud data is exempt from national laws because it resides in a virtual environment

Answer

Legal jurisdiction only applies to on-premises data storage

Question 2

What is a 'right to audit' clause in cloud contracts and why does CCSK consider it important?

Accepted Answer

A contractual provision giving customers the right to audit or verify the provider's security controls

Answer

A clause allowing the cloud provider to audit customer usage for billing

Answer

A regulatory requirement for annual financial audits of cloud services

Answer

A clause that limits liability if a security audit fails

Question 3

What is 'eDiscovery' in the context of CCSK and what cloud challenges does it present?

Accepted Answer

The legal process of identifying, collecting, and producing electronically stored information for legal proceedings, complicated in cloud by data distribution and provider access limits

Answer

A tool for discovering shadow IT cloud usage

Answer

A cloud provider's process for discovering security vulnerabilities

Answer

A compliance framework for electronic health records in cloud

Question 4

According to CCSK, what does 'compliance inheritance' mean for cloud customers?

Accepted Answer

Customers inherit compliance for the cloud infrastructure layer but remain responsible for compliance of their own applications and data

Answer

Customers automatically inherit all of the cloud provider's compliance certifications for their workloads

Answer

Compliance requirements are inherited from the customer's previous on-premises certifications

Answer

Cloud providers inherit customer compliance obligations when data is migrated

Question 5

What is the purpose of a 'service level agreement' (SLA) from a security perspective in CCSK?

Accepted Answer

SLAs define provider commitments for availability, security response times, and breach notification, creating contractual accountability

Answer

SLAs only address performance metrics and have no security relevance

Answer

SLAs allow customers to waive security requirements

Answer

SLAs are only relevant for SaaS services, not IaaS or PaaS

Question 6

What does CCSK recommend organizations do when a cloud provider cannot provide sufficient audit evidence?

Accepted Answer

Obtain third-party audit reports (SOC 2, ISO 27001) as a substitute for direct audit access

Answer

Accept the provider's verbal assurances as sufficient

Answer

Terminate the cloud contract immediately

Answer

Perform penetration testing on the provider's infrastructure