Internal Policy ComplianceGovernance, Risk, and Compliance (GRC)Benefits of GRC for CSPsGRC Program ImplementationIllustrative Control Objectives for Cloud ComputingA.5 Security policyA.6 Organization of information securityA.7 Asset managementA.8 Human resources securityA.9 Physical and environmental securityA.10 Communications and operations managementA.11 Access controlA.12 Information systems acquisition, development, and maintenanceA.13 Information security incident managementA.14 Business continuity managementA.15 ComplianceIncremental CSP-Specific Control ObjectivesAsset management, access controlInformation systems acquisition, development, and maintenanceCommunications and operations managementAccess controlComplianceAdditional Key Management Control ObjectivesKey managementControl Considerations for CSP UsersAccess controlInformation systems acquisition, development, and maintenanceOrganization of information securityRegulatory/External ComplianceSarbanes-Oxley ActCloud computing impact of SOXPCI DSSCloud computing impact of PCI DSSHIPAAAdministrative safeguardsAssigned security responsibilityPhysical safeguardsTechnical safeguardsSummary of HIPAA privacy standardsCloud computing impact of HIPAAOther RequirementsThe Control Objectives for Information and Related Technology (COBIT)Cloud computing impact of COBITCloud Security AllianceAuditing the Cloud for ComplianceInternal Audit PerspectiveExternal Audit PerspectiveAudit frameworkSAS 70SysTrustWebTrustISO 27001 certificationComparison of ApproachesSummary