Chapter 6 of 6 · ISC2 CCSP
Legal, Risk and Compliance
Cloud legal risks and eDiscovery, privacy laws and PIAs, cloud audits and SOC reports, enterprise risk, and cloud contracts.
- 6topics
- 30 minfast track
- 1diagrams and exhibits
- 13%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Legal Requirements and Unique Cloud RisksCCSP cloud legal risks: conflicting international laws, legal frameworks, eDiscovery with ISO/IEC 27050, and ISO/IEC 27037 to…5 min
- 2Privacy Issues and RequirementsCCSP privacy: contractual vs regulated data, PII and PHI, GDPR, HIPAA, FERPA, PIPEDA and India's DPDP Act, ISO/IEC 27018, GAPP…5 min
- 3Cloud Audit Controls and Audit ReportsCCSP cloud audit: internal and external controls, audit requirements, assurance challenges, SSAE 18 SOC 1, 2, 3, ISAE reports and…Diagram5 min
- 4Audit Planning, ISMS and Specialized ComplianceCCSP audit planning: gap analysis, ISMS and internal controls, policies, stakeholders, NERC CIP, HIPAA, HITECH, PCI and…5 min
- 5Cloud and Enterprise Risk ManagementCCSP cloud ERM: provider risk programs and appetite, data roles, breach notice, SOX and GDPR, risk treatment, frameworks, metrics…5 min
- 6Outsourcing and Cloud Contract DesignCCSP cloud contracts: SLA, MSA and SOW, vendor assessment, lock-in, viability and escrow, key clauses, and supply chain security…5 min
About this chapter
What this chapter covers
Legal, Risk and Compliance is 13% of the ISC2 CCSP exam. It covers the obligations that follow data into the cloud: the laws of every country it touches, the privacy rights of the people it describes, the audits that prove controls work, the risks the business accepts, and the contracts that bind the provider.
The domain covers legal requirements and unique cloud risks, including conflicting laws, eDiscovery and forensics standards (6.1), privacy requirements and laws such as GDPR, HIPAA, PIPEDA and India's Digital Personal Data Protection Act (6.2), audit processes and the adaptations cloud needs, including SOC and ISAE reports (6.3), the implications of cloud for enterprise risk management (6.4), and outsourcing and cloud contract design (6.5).
Questions are managerial. Expect to identify the law or report that applies, the data role a party plays, or the contract clause that BEST protects the customer.
How the topics fit together
Laws and privacy rules set the obligations, risk management decides how much risk the business accepts, and contracts pass the right duties to the provider. Audits then prove the provider meets them, and their findings feed back into risk decisions.
The customer remains the data controller and stays accountable to regulators, whatever the contract says. When an answer suggests the provider takes over legal responsibility for compliance, it is almost always wrong.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with tables and examples.
- What to remember for the exam: the facts to memorise and how questions are phrased.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Ready for more practice?
The full ISC2 CCSP question bank has 900 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.