An IT steering committee has received a report that supports the economic and service benefits of moving infrastructure hosting to an external cloud provider. Business leadership is very concerned abo

Mandating no customer data at rest may be overly restrictive, potentially negating the benefits of cloud hosting, and might not be technically feasible or necessary if proper controls are in place.

Including compliance with the enterprise's data governance policy in the contract is the most comprehensive way to address business leadership's concerns, as it legally binds the cloud provider to adhere to the organization's standards for data handling, protection, and privacy across all stages. This ensures the cloud provider manages data consistent with the enterprise's established rules and regulatory obligations.

While reporting and penalty clauses are important for accountability, they are reactive measures after data loss occurs and do not proactively prevent or govern the handling of data.

Requiring an encrypted connection is a specific technical control for data in transit, but it does not address the broader concerns of data at rest, data processing, or overall governance within the cloud provider's environment.