Cloud Control Framework

Supporting the Need for Compliant Cloud Environments
Ensuring IT risks are managed and compliance requirements are met has only intensified with the rapid
growth in adoption of Cloud Services. Deployment of production workloads, migration of regulated
systems and increasing storage of large volumes of data in the Cloud has driven the needfor security and controls to be effectively deployed across customer cloud environments.
However, typical approaches to cloud adoption often result in a disconnect
between technology and risk functions and an inability to address overarchingenterprise vision, effectively manage risk or meet evolving regulatory
requirements.

Common Challenges
Shared Responsibility Model
Requirements
A lack of understanding of responsibilities relating tocloud services, combined with a limited understanding of
nuanced differences between cloud services is a common
challenge faced by our clients.

Cloud skills shortages, training
and knowledge transfer

Disconnect between enterprise risk appetiteand technical controls implementation
A range of complex industry standards exist; however,alignment of specific enterprise drivers and compliancerequirements are not typically conducted when deploying
these controls.

Linkage between Risk & Compliance,
Security and Technical Teams

New technologies require enterprise training andupskilling to truly enable successful adoption andunderstanding of key services, and how contemporary
services can be utilised to secure an organisational cloudenvironment.

Risk and compliance teams traditionally require
substantial upskilling to adequately evaluate existing cloudenvironment compliance requirements, often relying on
external third-party support.

Cloud Service Provider control mapping

Complex, evolving and dynamic landscapeWhilst most large CSPs provide extensive services tosecure and control cloud environments, customers arefinding it difficult to ensure coverage and completenessacross their cloud environment.

In addition to the constantly evolving business landscape,organisations face uncertainty around alternate cloud
deployment challenges, such as adoption of hybrid cloud
deployments or overcoming scalability concerns.

INNOVATE. TRANSFORM. SUCCEED.

Cloud Control Framework

The Cloud Control Framework
The Cloud Control Framework provides a holistic, structured way to identify and manage your cloud risks
within the context of your business drivers and compliance obligations. It provides a mechanism for designinga fit-for-purpose cloud control environment, before architecting, implementing and optimising cloud services toembed and automate control activities.

1. Drivers

2.

Key drivers
underpin both
adoption of cloud
and the need forrisk management.

Cloud risk
management isscaled based on
tolerance and yourability to deploy
effective controls.

Strategy

Cloud Risks

IAAS

CloudRisks

PAAS
SAAS

3.

Cloud Controls

Effective cloud controls
enable mitigation ofoverriding risks andcompliance with regulatory
requirements.

4.

Mapping cloudcontrols to specific
Cloud Services
provides a roadmap
for implementation.

Cloud Services

Core Cloud Controls

AWS Services
e.g. IAM

Customer SpecificSharedRiskRegulation

Azure Services
e.g. Azure AD

Inherited
IAAS

Risk Levers
Level ofTolerance

Level of
Responsibility

High

Operational
Resilience

IAAS

Cloud Services

5.

Implement &Optimise

The final step is toimplement and optimise
cloud controls andservices within thecontext of a Well
Architected Framework.
Well Architected
Framework

Implementation

GCP Services
Oracle Services

High

Med PAAS

Cloud Regulatory
Controls

PAAS

e.g. AWS RDS

ZeroLow SAAS

e.g. Enhanced datacontrols requiredSAAS

e.g. Salesforce

Operational Management

Benchmarking

Outcomes
The Cloud Control Framework enables traceability, design and deployment of cloud controls at pace to meet
evolving enterprise risk, regulatory and strategic requirements.

INNOVATE. TRANSFORM. SUCCEED.

Cloud Control Framework

Benefits Provided
The Cloud Control Framework results in the rapid deployment of cloud controls and services, the automation ofcontrol activities and the agility to adapt to changing regulatory requirements over time. In addition, ourframework provides value through each of the following:

Linkage of core enterprisedrivers (risk appetite,regulation, strategy, etc.) totypical cloud risks acrossdifferent service types.

Rapid deployment of cloudcontrols and services and theautomation of control
activities

Mapping of common cloud
risks to industry-standard
controls for mitigation(including regulated entities).

Tailored mapping of industry
standard cloud controls toplatform agnostic controls,
as well as CSP-specificcontrols.

Heightened connectivity
between enterprise risk
management, process andtechnology business
functions.

Agility to adapt to changing
regulatory requirements overtimeContact https://www.protiviti.com/AU-en/technology-consulting/cloud-solutions

David Kissane

Darryn LongManaging Director & APAC Lead,Enterprise Cloud
Contact: David.Kissane@protiviti.com.au

Director, Enterprise Cloud

LinkedIn Profile

INNOVATE. TRANSFORM. SUCCEED.

Contact: Darryn.Long@protiviti.com.au
LinkedIn Profile