CISM · Question #127
When evaluating cloud storage solutions, the FIRST consideration should be:
The correct answer is D. alignment with the organization's data classification policy. The first consideration when evaluating cloud storage should be alignment with the organization's data classification policy, as this policy dictates the security requirements for different types of data.
Question
When evaluating cloud storage solutions, the FIRST consideration should be:
Options
- Ahow the organization's sensitive data will be transferred.
- Bthe service level agreement (SLA) for encryption keys.
- Cthe volume of data to be stored in the cloud.
- Dalignment with the organization's data classification policy.
How the community answered
(38 responses)- A5% (2)
- B8% (3)
- C3% (1)
- D84% (32)
Why each option
The first consideration when evaluating cloud storage should be alignment with the organization's data classification policy, as this policy dictates the security requirements for different types of data.
How data will be transferred is a technical detail addressed *after* understanding the data's classification and its security requirements.
The SLA for encryption keys is a critical security detail, but it's evaluated based on the requirements stemming from data classification.
The volume of data is a cost and scalability consideration, which is secondary to ensuring the solution can meet the fundamental security requirements for the data type.
An organization's data classification policy categorizes data based on its sensitivity and value, which directly determines the required level of security, compliance, and residency for storage solutions. Without understanding the classification of data, it's impossible to properly evaluate if a cloud solution meets the necessary security, privacy, and regulatory controls.
Concept tested: Data classification and cloud security
Topics
Community Discussion
No community discussion yet for this question.