Legal, Risk and Compliance · Topic 1 of 6
Legal Requirements and Unique Cloud Risks
CCSP cloud legal risks: conflicting international laws, legal frameworks, eDiscovery with ISO/IEC 27050, and ISO/IEC 27037 to 27043 forensics.
- 5 min
- Several jurisdictions can apply to the same cloud data at once.
- Legal conflicts are resolved by counsel and management, supported by technical controls.
- ISO/IEC 27050 is eDiscovery; 27037 collection and preservation; 27041 method assurance; 27042 analysis; 27043 investigation process.
What it is
Cloud data can be stored in one country, processed in another and managed by a provider headquartered in a third. Each may claim legal authority over it. The CCSP expects you to recognize where laws conflict, which legal risks the cloud creates, and how eDiscovery and forensic requirements apply when you cannot touch the hardware.
How it works
Conflicting international legislation
| Conflict | Example |
|---|---|
| Government access versus privacy | A provider subject to the US CLOUD Act may be ordered to produce data stored abroad, while GDPR restricts transfers to non-EU authorities |
| Data localization | Some countries require certain data to stay inside their borders, limiting region and backup choices |
| Retention versus erasure | One law requires keeping records for years; another gives people the right to have their data erased |
| Disclosure versus secrecy | Breach notification laws require disclosure; other laws or court orders can forbid it |
There is rarely a technical answer to a legal conflict. The security professional identifies it, legal counsel advises, and management decides, often supported by technical measures such as region restriction and customer held keys.
Evaluation of legal risks specific to cloud
- Jurisdiction: the laws of the data location, the provider's home country and the customer's country may all apply.
- Loss of control: the customer cannot directly inspect or seize the infrastructure.
- Subcontractors: the provider may use other providers, each adding locations and legal exposure.
- Multi-tenancy: a legal order against another tenant could affect shared resources.
- Provider failure or acquisition: data may fall under a new owner or a different jurisdiction.
- Contract gaps: unclear terms on data ownership, location, breach notification and exit.
Legal and regulatory frameworks and guidelines
| Type | Examples |
|---|---|
| Criminal law | Computer misuse and fraud statutes; prosecuted by the state |
| Civil law | Contract and tort disputes between parties |
| Administrative or regulatory law | Rules from agencies, such as data protection authorities or financial regulators |
| Privacy and data protection | GDPR, HIPAA, PIPEDA, India's Digital Personal Data Protection Act |
| Industry and sector rules | PCI DSS (contractual), NERC CIP (electric sector), SOX (US public companies) |
| Guidelines | OECD privacy guidelines, CSA Security Guidance, ISO/IEC standards |
Legal systems also differ: common law countries rely heavily on case precedent, while civil law countries rely mainly on written codes. This affects how contracts are interpreted and disputes resolved.
eDiscovery
Electronic discovery is identifying, preserving, collecting, processing, reviewing and producing electronically stored information for legal proceedings. ISO/IEC 27050 gives guidance on the eDiscovery process, and the CSA Security Guidance discusses how it applies in cloud.
Cloud challenges:
- Finding all relevant data across services, regions and backups.
- Preserving it under legal hold when retention policies would delete it.
- Getting data from the provider in a usable format with metadata intact.
- Collecting only the relevant tenant's data without exposing others.
- Meeting court deadlines when the provider controls the timeline.
Contracts should cover the provider's support for eDiscovery, including legal hold features, export formats and response times.
Forensics requirements
| Standard | Covers |
|---|---|
| ISO/IEC 27037:2012 | Identification, collection, acquisition and preservation of digital evidence |
| ISO/IEC 27041:2015 | Assuring that investigative methods are suitable and adequate |
| ISO/IEC 27042:2015 | Analysis and interpretation of digital evidence |
| ISO/IEC 27043:2015 | Principles and processes for incident investigation |
The CSA guidance adds the cloud view: plan forensic capability with the provider in advance, understand what evidence each service category provides, and rely on logical rather than physical acquisition.
For evidence to be useful in court it generally must be authentic, accurate, complete, reliable and lawfully obtained, with an unbroken chain of custody.
A worked example
A European retailer uses a US headquartered SaaS provider that stores data in an EU region. A US court order asks the provider for records of a European customer. GDPR restricts disclosure to foreign authorities without a recognized legal basis.
The provider's contract commits it to notify the customer of such requests where lawful and to challenge overbroad ones. The retailer had also chosen customer held encryption keys, so the provider cannot decrypt the content without the retailer's involvement. Legal counsel handles the response.
How the exam asks about this
- "Which standard provides guidance on the eDiscovery process?" ISO/IEC 27050.
- "Which ISO standard covers identification, collection, acquisition and preservation of digital evidence?" ISO/IEC 27037.
- "A data localization law conflicts with a provider's global replication. Who should decide how to proceed?" Management, advised by legal counsel.
What to remember for the exam
- Several jurisdictions can apply to the same cloud data at once.
- Legal conflicts are resolved by counsel and management, supported by technical controls.
- ISO/IEC 27050 is eDiscovery; 27037 collection and preservation; 27041 method assurance; 27042 analysis; 27043 investigation process.
- eDiscovery needs location knowledge, legal hold and provider support written into the contract.
- PCI DSS is a contractual standard, not a law.
Collecting more than the relevant data during eDiscovery can expose other tenants or unrelated personal data, creating a new privacy breach.
Common mistakes
Assuming the data center's country is the only law. The provider's home country and the data subjects' countries may also apply.
Treating legal conflicts as technical problems. Engineers provide options; legal counsel advises and management decides.
Mixing up the forensic ISO standards. Learn the one line focus of 27037, 27041, 27042 and 27043.
Check yourself
What is eDiscovery?
The process of identifying, preserving, collecting, processing, reviewing and producing electronically stored information for legal proceedings.
Why can a provider's home country matter even when data is stored elsewhere?
Its laws may compel the provider to produce data it controls regardless of where the data is stored.
What does ISO/IEC 27042 cover?
The analysis and interpretation of digital evidence.
Topic 1 of 6 in Legal, Risk and Compliance
Test yourself on Legal, Risk and Compliance
The full ISC2 CCSP question bank has 900 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.