Project 2: Cloud Risk and Compliance Issues Analysis
Step 4: Create Risk Management Matrix

Now that you have identified and described the types of risks that may apply to your organization, create a 

risk management matrix
 to assess/analyze that risk and make recommendations for risk mitigation measures.

anagement Matrix

Print

When conducting a risk assessment for cloud computing in the elections industry, you will categorize risks based on the likelihood of an incident occurring, and the seriousness of the impact.

The image below shows an example of how to categorize risks with a risk matrix. anagement Matrix

Print

When conducting a risk assessment for cloud computing in the elections industry, you will categorize risks based on the likelihood of an incident occurring, and the seriousness of the impact.

The image below shows an example of how to categorize risks with a risk matrix.

Risk Matrix

Risk Matrix

This 

Sample Risk Assessment for Cloud Computing
 will give you an example of a completed risk matrix.

Use the 

risk management matrix template
 to identify risks and write a brief summary explaining how to understand the data. Submit it for feedback using the steps described below.

Now that you have completed the risk analysis, you can start to identify 
cloud and network security issues that may apply in BallotOnline’s operating environment, including 
data in transit vulnerabilities and 
multifactor authentication.

Consider cloud computing risks, 
network security design, 
information security, data classifications, and 
identity management issues. Your findings will be incorporated into your final report.

Discuss these security issues with your colleagues in the Discussion: Security Issues forum.

Now that you are familiar with security issues, examine and review the 
US legal and justice systems. Since BallotOnline is a software as a service (SaaS) company based in the United States and serving a customer base in the United States, you need to understand how the legal and justice systems work in the United States. Your basic understanding of these systems is crucial for understanding the complexities of the legal system in cyberspace, where cloud-based systems reside.

As a practitioner working in the cloud computing field, you should also have an understanding of the complexities of 
intellectual property law and 
cyberspace law, including how to identify different venues and methods for resolving disputes (such as the court system, arbitration, mediation), how to define and negotiate cloud hosting agreements to avoid potential cyberspace law issues, how to discuss the regulation of cyberspace, and how to handle electronic agreements and digital signatures.

To gain a better understanding of how cyberspace laws are applied to real issues, participate in the analysis of a relevant legal case with your colleagues in a forum titled Discussion: US Legal System and Cyberspace Law.

In addition to the discussion board, your findings will also be incorporated into your Final Risk and Compliance Report for the BallotOnline executives.

In the previous step, you examined the US legal and justice systems as a building block for understanding the complexities of the legal system in cyberspace, where cloud-based systems reside.

There are several 
frameworks for analyzing compliance issues used to analyze these complex issues. To provide a manageable set of recommendations to the executives, review the frameworks and select the one that is most helpful to use for analyzing these complex issues.

In the previous step, you examined the complexities of law in cyberspace. In this step, you will expand your understanding of legal and compliance issues related to the cloud by investigating 
industry-specific compliance issues, 
geographic-specific compliance issues such as privacy, and 
cloud-specific compliance issues to determine which are applicable to BallotOnline.

You will also need to analyze 
data compliance issues applicable to companies operating in the European Union, including the recent GDPR regulations, and determine how BallotOnline can be compliant. The organization is concerned about EU compliance issues because the laws there are the most restrictive that BallotOnline will encounter.

Prepare a two- to three-page summary of the data compliance issues that are applicable to BallotOnline and determine how BallotOnline can be compliant. This will be part of your final risk and compliance assessment report.

In previous steps, you have identified potential legal and compliance requirements that BallotOnline may face in migrating to a cloud computing model. Now, you need to determine how BallotOnline can comply with those requirements.

Create a high-level proposal for a compliance program for BallotOnline that enables the organization and its employees to conduct itself in a manner that is in compliance with legal and regulatory requirements. Management has asked you to model the proposal on 
existing compliance programs for other companies that have migrated to the cloud.

Use the 
Proposal for Compliance Program template to record your work and follow the submission instructions below to obtain feedback.

********** The proposal will be one to two pages in length and should take the form of a high-level outline or flowchart showing the different components and relationships among the components.

Include the following elements that are generally found in an effective program:

· Identification of company employees who have oversight over the program, their roles, and responsibilities

· List of high-level policies and/or procedures that may be required

· List of high-level training and education programs that may be required

· Relationships between components of the program, including (but not limited to):

· communication channels

· dependencies

· Identification of enforcement mechanism

· Identification of monitoring and auditing mechanisms

· How will responses to compliance issues be handled, and how will corrective action plans be developed?

· How are risk assessments handled? ************

$####################################################

As you have learned, there are a number of legal and compliance requirements associated with shifting to a cloud computing model.

It’s time to put everything together in a seven- to 10-page report for BallotOnline executives: summarizing the risk assessment and mitigation as well as legal and compliance requirements associated with moving to the cloud, outlining your recommended action plans for meeting those requirements, and developing a high-level proposal for a compliance program to avoid breaches of the requirements.

Use the 
final risk and compliance report template to complete your report. When you are finished, submit your work after reviewing the instructions below.

image2.gif

image1.gif