Including key metrics and periodic reassessment in cybersecurity governance is essential for ensuring the effective and continuous improvement of security measures. Metrics provide a way to assess the current state of security, identify gaps, and measure progress over time. Periodic reassessment allows organizations to adapt to emerging threats and vulnerabilities, ensuring that security controls remain relevant and effective as the threat landscape evolves.
While meeting legal requirements is important, the primary reason for metrics and reassessment is continuous improvement, not just legal compliance. Documenting cybersecurity incidents is important, but the main focus of key metrics and reassessment is improving and adapting security strategies. Zero security incidents is not feasible; the goal is to reduce incidents and manage risk, not to eliminate all incidents entirely.

The correct answer isB. Customers retain control over their encryption keys.
Usingcustomer-managed encryption keys (CMEK)with a cloudKey Management Service (KMS)allows the customer toretain full control over the encryption keysused to encrypt their data. This is crucial in maintaining data sovereignty, privacy, and compliance with regulatory requirements.
Key Benefits of Customer-Managed Encryption Keys:
Key Ownership and Control:Unlike cloud provider-managed keys, CMEK ensures that the customer has full authority over the key's lifecycle, including creation, rotation, and deletion.
Enhanced Security:Customers can enforce strict access controls and audit who accesses the keys.
Compliance:Many regulations (like GDPR or HIPAA) mandate that data owners maintain control over encryption keys.
Data Privacy:Even though the data is stored on the cloud, the provider cannot access unencrypted data without the customer's permission.
Flexibility:Customers can choose when to revoke or rotate keys, which directly impacts data availability and access.
Why Other Options Are Incorrect:
A: Bypass the need for encryption:CMEK does not eliminate the need for encryption; it strengthens it by giving customers direct control.
C: Share encryption keys more easily:Sharing encryption keys can increase security risks, and CMEK is designed to restrict, not ease, key sharing.
D: Reduces computational load on the cloud service provider:CMEK does not impact the computational load.
It focuses on key management and control rather than reducing processing overhead.
Real-World Example:
InAWS KMS, using CMEK allows customers to bring their own keys (BYOK) and manage them directly through AWS Key Management Service. Similar practices exist inGoogle Cloud KMSandAzure Key Vault, where customers can generate and control their own encryption keys.
Practical Use Case:
A healthcare provider using a cloud service to store patient records may use CMEK to ensure that sensitive data is encrypted under keys they control, ensuring compliance with regulations likeHIPAA.
References:
CSA Security Guidance v4.0, Domain 11: Data Security and Encryption
Cloud Computing Security Risk Assessment (ENISA) - Key Management and Encryption Cloud Controls Matrix (CCM) v3.0.1 - Data Protection and Encryption Domain

Serverless environments are vulnerable to misconfigurations, which can expose sensitive data and resources, making security configurations critical. Reference: [Security Guidance v5, Domain 8 - Cloud Workload Security][16 source].

Aligning CSP policies with security and regulatory objectives is essential for ensuring compliance and robust security measures. Reference: [Security Guidance v5, Domain 3 - Risk, Compliance, and Governance]

Encryption in object storage is used to secure stored data and protect it from unauthorized access, ensuring confidentiality. Reference: [Security Guidance v5, Domain 9 - Data Security]