Legal, Risk and Compliance · Topic 5 of 6
Cloud and Enterprise Risk Management
CCSP cloud ERM: provider risk programs and appetite, data roles, breach notice, SOX and GDPR, risk treatment, frameworks, metrics and environment.
- 5 min
- Assess the provider's controls, methods, policies, risk profile and risk appetite.
- Owner decides; controller sets purposes; processor acts on instruction; custodian protects; steward manages quality.
- Breach notification, SOX and GDPR transparency stay the customer's obligations.
What it is
Enterprise risk management (ERM) looks at risk across the whole organization and decides how much to accept in pursuit of its goals. Cloud adoption changes ERM: some risks are shared with providers, new dependencies appear, data roles must be clear, and transparency duties continue whoever runs the systems.
How it works
Assessing a provider's risk management program
| Area | What to examine |
|---|---|
| Controls | Which controls exist, mapped to a framework such as the CSA CCM, and audit evidence that they operate |
| Methodologies | How the provider identifies and assesses risk, and how often |
| Policies | Security, privacy, incident, change and subcontractor policies |
| Risk profile | The provider's own exposure: size, locations, past incidents, financial health |
| Risk appetite | How much risk the provider is willing to take, and whether it is compatible with the customer's |
A provider with a higher risk appetite than the customer, for example releasing features with minimal testing, is a mismatch even if its controls look strong.
Difference between data roles
| Role | Definition |
|---|---|
| Data owner | The business person accountable for a data set, who classifies it and decides access |
| Data controller | Under privacy law, the party that determines the purposes and means of processing personal data |
| Data processor | Processes personal data on the controller's behalf, such as a cloud provider |
| Data custodian | Implements and operates the controls that protect data, such as IT or the provider's operations staff |
| Data steward | Manages data quality, definitions and metadata for the business |
The data subject is the person the data is about. A cloud customer is usually the controller and the provider a processor; a provider that uses customer data for its own purposes may become a controller for that processing.
Regulatory transparency requirements
- Breach notification: laws such as GDPR require notifying the supervisory authority within 72 hours and affected individuals without undue delay when the risk is high; US states and sector laws set their own rules.
- Sarbanes-Oxley (SOX): US public companies must maintain and report on internal control over financial reporting; cloud services that support financial systems fall in scope, which is why SOC 1 reports matter.
- GDPR transparency: individuals must be told who processes their data, for what purposes, where it goes and their rights.
Contracts must make the provider notify the customer quickly so the customer can meet its own deadlines.
Risk treatment
| Treatment | Cloud example |
|---|---|
| Avoid | Keep a workload on premises because no provider meets a localization law |
| Mitigate | Add customer managed encryption and multi-region backup |
| Transfer | Buy cyber risk insurance |
| Share | Allocate duties and liabilities with the provider through the contract |
| Accept | Owner formally accepts a residual risk within appetite |
Different risk frameworks
| Framework | Focus |
|---|---|
| ISO 31000 | General risk management principles and process for any organization |
| ISO/IEC 27005 | Information security risk management supporting an ISO/IEC 27001 ISMS |
| NIST SP 800-37 (RMF) | Seven step risk management framework for systems: prepare, categorize, select, implement, assess, authorize, monitor |
| NIST CSF 2.0 | Six functions: Govern, Identify, Protect, Detect, Respond, Recover |
| COSO ERM | Enterprise risk management integrated with strategy and performance |
| ENISA cloud risk assessment | European guidance on the risks and benefits of cloud computing |
Metrics for risk management
Good metrics are measurable, relevant to a decision and tracked over time. Examples:
- Key risk indicators (KRIs): number of critical misconfigurations open longer than 30 days; share of privileged accounts without MFA.
- Key performance indicators (KPIs): mean time to detect and respond; patch compliance rate.
- Provider metrics: SLA attainment, incident counts, time to notify.
KRI: privileged accounts without phishing-resistant MFA
Threshold: 0 tolerated; amber 1 to 2; red 3 or more
This month: 4 of 120 accounts (red) -> escalate to risk committeeAssessment of the risk environment
| Dimension | Questions |
|---|---|
| Service | How critical is the service? What happens if it fails or is breached? |
| Vendor | Is the provider financially viable, well governed, dependent on subcontractors? |
| Infrastructure | How resilient and isolated is the platform? Where does it run? |
| Business | How does the cloud change strategy, regulatory exposure and concentration risk? |
Concentration risk arises when many critical services depend on one provider or one region.
A worked example
A bank's risk committee reviews its use of a single cloud provider for core banking, payments and customer apps. The KRI for concentration shows all three critical services in one region.
The committee assesses the provider's risk program, finds its appetite and controls acceptable, but treats concentration risk by requiring a second region for payments and a tested exit plan for core banking. The residual risk is accepted by the chief risk officer and reported to the board.
How the exam asks about this
- "Which party determines the purposes and means of processing personal data?" The data controller.
- "Which role implements and maintains the controls that protect data?" The data custodian.
- "Which NIST CSF 2.0 function was added to address governance?" Govern.
What to remember for the exam
- Assess the provider's controls, methods, policies, risk profile and risk appetite.
- Owner decides; controller sets purposes; processor acts on instruction; custodian protects; steward manages quality.
- Breach notification, SOX and GDPR transparency stay the customer's obligations.
- Treatment options: avoid, mitigate, transfer, share, accept.
- Assess service, vendor, infrastructure and business dimensions, including concentration risk.
Risk metrics only help if they lead to decisions. A KRI with no threshold or no owner is just a number.
Common mistakes
Calling the provider the data owner. The provider is usually a processor and custodian; the customer owns and controls the data.
Ignoring risk appetite mismatch. A provider comfortable with more risk than you can accept is a poor fit, even with good certifications.
Treating transfer as elimination. Insurance pays for losses; it does not stop the breach or the regulator.
Check yourself
What is the difference between a data owner and a data custodian?
The owner is accountable for the data and decides classification and access, while the custodian implements and operates the controls that protect it.
What is concentration risk in cloud?
The risk that many critical services depend on a single provider or region, so one failure affects them all.
What are the six functions of NIST CSF 2.0?
Govern, Identify, Protect, Detect, Respond and Recover.
Topic 5 of 6 in Legal, Risk and Compliance
Test yourself on Legal, Risk and Compliance
The full ISC2 CCSP question bank has 900 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.