A.build an operational cloud risk management program.

B.define different control frameworks for different cloud service providers.

C.facilitate communication with their legal department.

D.develop new security baselines for the industry.

A.be reviewed and updated if required.

B.not be reviewed as the SLA cannot be updated.

C.not be reviewed, but the cloud contract should be cancelled immediately.

D.be reviewed, but the SLA cannot be updated.

A.No source escrow agreement

B.Unclear asset ownership

C.Lack of information onjurisdictions

D.Audit or certification not available to customers

E.Lack of completeness and transparency in terms of use

A.start a compliance assessment using latest assessment.

B.help identify controls with common assessment status.

C.avoid duplication of work when assessing compliance.

D.help identify controls with different assessment status.

A.Incorporation of automation to identify and address software code problems early

B.Maturity of start-up entities with high-iteration to low-volume code commits

C.Large entities with slower release cadences and geographical dispersed systems

D.A waterfall model to move resources through the development to release phases