Cloud Service Provider Risk Assessment

Cloud Service Provider Risk Assessment

Cloud Service Models

| Model | Provider Manages | Customer Manages | |-------|------------------|------------------| | IaaS | Infrastructure | OS, apps, data | | PaaS | Infrastructure + platform | Apps, data | | SaaS | Everything | Data, access |

Shared Responsibility Model

Provider Responsibilities

• Physical security
• Infrastructure availability
• Platform security (PaaS/SaaS)
• Compliance certifications

Customer Responsibilities

• Data classification
• Access management
• Application security
• Configuration management
• Monitoring

Risk Assessment Areas

1. Security and Privacy

• Data encryption (transit and rest)
• Access controls and IAM
• Network security
• Vulnerability management
• Incident response
• Data residency

2. Availability and Resilience

• SLA commitments
• Architecture redundancy
• Disaster recovery
• Performance monitoring
• Capacity management

3. Compliance

• Regulatory alignment
• Certification (SOC 2, ISO 27001)
• Audit rights
• Data protection (GDPR)
• Industry-specific (PCI, HIPAA)

4. Operational

• Change management
• Patch management
• Support levels
• Service notifications
• Integration capabilities

5. Exit and Portability

• Data export capabilities
• API availability
• Lock-in considerations
• Transition support
• Data deletion

Due Diligence Documents

• SOC 2 Type II report
• ISO 27001 certificate
• Penetration test summary
• SLA documentation
• Data processing agreement
• Subprocessor list

Contract Considerations

• Clear SLAs and remedies
• Data protection clauses
• Audit rights
• Subcontracting restrictions
• Termination provisions
• Data return/destruction

Ongoing Monitoring

• SLA performance tracking
• Security bulletin monitoring
• Certification renewals
• Incident notifications
• Annual reassessment

Multi-Cloud Considerations

• Consistent security baseline
• Vendor diversification
• Portability requirements
• Skills and training
• Governance complexity