Data Governance in the Cloud

Written by Ashwin Chaudhary, CEO, Accedere.

As all organizations are moving towards the digitization of data and cloud computing, it is important to protect and ensure data governance by all organizations. New data security solutions are needed considering data digitization and cloud computing. According to Gartner, “By 2025, 80% of organizations seeking to scale digital business will fail because they do not take a modern approach to data and analytics governance”.

What is data governance?

“Ensuring the use of data and information complies with organizational policies, standards, and strategy —including regulatory, contractual, and business objectives” as defined in Domain 5 Information Governance in Cloud Security Alliance’s Security Guidance for Critical Areas of Focus in Cloud Computing v4.0.

Cloud Information Governance Domains

Information Classification- Data/Information classification is an important data governance control as the data/information needs to be categorized based on sensitivity and importance. Organizations need to implement this control to ensure data governance in the cloud as per ISO/IEC 27001:2022.

Information Management Policies- Defining and implementing information management policies based on cloud services namely SaaS, PaaS, and IaaS used by the organizations become one of the important controls for the organizations to ensure data governance in the cloud.

Location and Jurisdiction Policies- Considering the location, legal requirements, and jurisdiction of the data storage becomes an important aspect for organizations to ensure data governance in the cloud.

Authorizations- Providing the least privileges and access, also conducting access reviews becomes important for organizations to ensure data governance in the cloud.

Ownership- Identifying the owner of data stored in the cloud is an important control to be implemented by the organization for ensuring data governance in the cloud.

Custodianship- Though the cloud service provider is the custodian of data stored in the cloud, Organizations need to ensure that data is properly encrypted, and security controls are in place to ensure data governance in the cloud.

Privacy- The Identification of PII data, conducting Privacy Impact Assessment, Data Privacy Impact Assessment, and implementing relevant privacy controls become an important activity for organizations to ensure data governance in the cloud.

Contractual controls- Identifying and implementing legal and statutory requirements enable assurance to third parties. This also become one of the important controls for the organization to ensure data governance in the cloud.

Security controls- Identifying and implementing relevant security controls like data encryption, access control, change management, and incident management become mandatory for organizations to ensure data governance in the cloud.

Recommendations

• Before planning a cloud migration, determine your data and information governance needs. This includes legal, regulatory, contractual, and other corporate rules as per ISO/IEC 27001:2022.
• Enforce cloud-native information governance policies, procedures, and controls implementation audited based on CSA STAR Level SOC 2 Type 2 attestation or ISO/IEC 27001:2022 certification.
• Consider Training, Risk Management, and Information Security control implementation as per Cloud Controls Matrix (CCM v4), CCM Lite.

About the Author

Ashwin Chaudhary is the CEO of Accedere, a Data Security, Privacy Audit, and Training Firm. He is a CPA from Colorado, MBA, CITP, CISA, CISM, CGEIT, CRISC, CISSP, CDPSE, CCSK, PMP, ISO27001 LA, ITILv3 certified cybersecurity professional with about 20 years of cybersecurity/privacy and 40 years of industry experience. He has managed many cybersecurity projects covering SOC reporting, ISO audits, VAPT assessments, Privacy, IoT, Governance Risk, and Compliance.