Cloud Compliance and Governance Cheat Sheet

Updated 2026-05-25

🧠Study flashcards on this topic104 cards · spaced repetition→

Cloud compliance and governance form the critical oversight framework that ensures cloud infrastructure operates securely within regulatory boundaries while meeting business and legal obligations. As organizations migrate workloads to the cloud, they must navigate an increasingly complex landscape of data privacy laws, industry-specific regulations, security standards, and shared responsibility models that define who owns which security controls. Compliance is not a one-time checkbox — it's a continuous program of policy enforcement, automated monitoring, audit-ready evidence collection, and risk-based decision-making. Understanding the distinction between regulatory requirements (what the law demands), certification standards (what third-party audits validate), and governance frameworks (how you operationalize both) is essential for building resilient, audit-ready cloud environments that scale without sacrificing trust or exposing the organization to regulatory penalties.

What This Cheat Sheet Covers

This topic spans 10 focused tables and 103 indexed concepts, 104 flashcards. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.

Table 1: Major Compliance Standards and RegulationsTable 2: Cloud Governance Frameworks and PoliciesTable 3: Audit and Attestation MechanismsTable 4: Data Protection RequirementsTable 5: Access Control and Identity ManagementTable 6: Monitoring and Incident ResponseTable 7: Vendor and Third-Party Risk ManagementTable 8: Compliance Automation Tools and TechnologiesTable 9: Emerging Trends and Advanced TopicsTable 10: Cloud-Specific Compliance Considerations

Quick IndexSubscribe to unlock

A jump-to index of every table row in this cheat sheet.

Mind MapSubscribe to unlock

An interactive map of every table and concept in this topic.

Table 1: Major Compliance Standards and Regulations

The regulatory landscape for cloud environments has expanded dramatically — spanning U.S. federal and state privacy laws, EU digital regulations, financial-sector resilience mandates, and international AI governance standards. Each framework assigns specific obligations; knowing which applies to your environment and data is the first step of any compliance program.

Standard	Example	Description
GDPR (General Data Protection Regulation)	Data processing consent, right to erasure, data portability, breach notification within 72 hours	• EU regulation enforcing data privacy and sovereignty for personal data of EU citizens • applies globally to any organization processing EU data • penalties up to 4% of annual global revenue or €20M • requires data protection impact assessments (DPIAs) for high-risk processing.
HIPAA (Health Insurance Portability and Accountability Act)	MFA everywhere, encryption at rest/in transit, 72-hour data restoration, annual penetration testing	• U.S. healthcare data protection law requiring technical, physical, and administrative safeguards for electronic protected health information (ePHI) • 2026 Security Rule updates mandate MFA, annual pentests, and biannual vulnerability scanning • Business Associate Agreements (BAAs) required for cloud vendors.
PCI DSS (Payment Card Industry Data Security Standard)	PCI DSS 4.0.1: Tokenization, network segmentation, quarterly ASV scans, targeted risk analysis	• Mandates 12 foundational security requirements for any organization that stores, processes, or transmits payment card data • non-compliance fines range $5,000–$100,000/month • v4.0.1 adds targeted risk analysis, enhanced multi-factor requirements, and expanded e-commerce controls.
SOC 2 Type II	6–12 month observation of controls' operational effectiveness against Trust Services Criteria	• Evaluates both design and operating effectiveness of controls over a minimum 6-month period • covers security, availability, confidentiality, processing integrity, and privacy • provides deeper assurance than Type I and is preferred by enterprise customers • requires continuous evidence collection.
ISO 27001	Risk-based ISMS with 93 controls across 4 themes (2022 edition)	• International standard for information security management systems (ISMS) • ISO 27001:2022 restructured controls into Organizational, People, Physical, and Technological themes • certification involves third-party audit and surveillance audits every 1–3 years.
FedRAMP (Federal Risk and Authorization Management Program)	Low, Moderate, High authorization levels based on data sensitivity	• U.S. government cloud security assessment program requiring CSPs to achieve standardized security authorization before handling federal data • built on NIST 800-53 controls • reduces duplicative audits across agencies • FedRAMP 20x modernization (2025) streamlines the authorization process.
NIST Cybersecurity Framework (CSF 2.0)	Govern, Identify, Protect, Detect, Respond, Recover	• Voluntary U.S. framework organizing cybersecurity activities into six functions • CSF 2.0 (2024) adds "Govern" function and emphasizes supply chain risk and organizational accountability • widely adopted for building risk-based security programs across sectors.
DORA (Digital Operational Resilience Act)	EU bank must maintain tested failover for trading systems; document cloud provider contingency plans	• EU regulation effective January 17, 2025 requiring financial entities and their critical ICT providers (including cloud CSPs) to maintain operational resilience • five pillars: ICT risk management, operational continuity, third-party oversight, incident reporting, and information sharing • extraterritorial: applies to non-EU companies providing ICT services to EU financial firms.
NIS2 Directive	EU cloud provider must report major incidents within 24 hours (early warning) and 72 hours (full notification)	• EU cybersecurity law effective October 17, 2024, expanding to 18+ sectors including cloud providers, SaaS, managed services, and healthcare • Essential entities: fines up to €10M or 2% of global revenue; Important entities: €7M or 1.4% • executives personally accountable for cybersecurity governance failures.
CCPA / CPRA (California Consumer Privacy Act / Privacy Rights Act)	Opt-out from data sale, deletion requests, sensitive PI protections, risk assessments	• California privacy law granting consumer data rights similar to GDPR • CPRA amendments require 30-day breach notification, privacy risk assessments, and cybersecurity audits for high-risk businesses • California Privacy Protection Agency (CPPA) actively enforcing.
CMMC (Cybersecurity Maturity Model Certification)	Level 1 (17 practices), Level 2 (110 NIST 800-171 practices), Level 3 (advanced)	• U.S. Department of Defense framework for DIB (Defense Industrial Base) cybersecurity • phased mandatory certification for DoD contractors began November 2025 • enforces NIST 800-171 and 800-172 controls • unannounced assessments allowed for Level 3.
SOC 2 Type I	Point-in-time audit of access controls and encryption design	• Assesses whether security controls are properly designed at a single point in time against TSC • does not test operational effectiveness over time • useful as a first milestone before pursuing Type II.
CSA STAR (Cloud Security Alliance Security Trust Assurance and Risk)	Level 1 (self-assessment), Level 2 (third-party audit), Level 3 (continuous monitoring)	• Three-tier cloud security certification program using the Cloud Controls Matrix (CCM) • Level 2 combines ISO 27001 with CSA-specific controls • publicly listed in CSA STAR Registry for customer due diligence.
CIS Benchmarks	Hardening guides for AWS, Azure, GCP, Kubernetes, Docker, OS	• Prescriptive configuration standards for securing IT systems and cloud platforms • two implementation levels: L1 (basic, low risk), L2 (advanced, higher security) • continuously updated by consensus; CSPM tools map findings to CIS controls automatically.
ISO/IEC 42001 (AI Management System)	AIMS documenting training data provenance, bias testing, human oversight procedures	• First international standard for AI management systems (December 2023) • provides requirements for organizations that develop, provide, or use AI systems • seven pillars: leadership, objectives, AI risk management, data governance, transparency, monitoring, continual improvement • aligns with EU AI Act high-risk obligations due August 2026.
SEC Cybersecurity Disclosure Rules	Publicly traded company files Form 8-K within 4 business days of material breach	• U.S. SEC rules (effective December 2023) requiring public companies to disclose material cybersecurity incidents within four business days • annual Form 10-K disclosure of cybersecurity risk management, strategy, governance, and board oversight • applies to domestic registrants and foreign private issuers.

Table 2: Cloud Governance Frameworks and Policies

Governance is the set of policies, processes, and organizational structures that keep cloud usage aligned with business objectives, security requirements, and compliance obligations. Understanding how authority is divided, policies are codified, and guardrails are enforced is the foundation for scalable cloud operations.

Concept	Example	Description
Shared Responsibility Model	CSP secures cloud infrastructure; customer secures data, apps, IAM	• Fundamental division of security ownership in cloud: provider manages "security of the cloud" (physical, network, hypervisor) • customer manages "security in the cloud" (OS, apps, identity, encryption) • obligations shift significantly by service model (IaaS vs. PaaS vs. SaaS).

The rest of this section is part of the full cheat sheet

Table 3: Audit and Attestation Mechanisms

Continuous, evidence-based audit readiness is what separates mature compliance programs from checkbox exercises. These mechanisms translate security controls into verifiable proof that auditors, regulators, and customers can independently validate.

Mechanism	Example	Description
Continuous Control Monitoring (CCM)	Automated daily scans validating MFA enforcement, encryption status, access review completion	• Real-time validation that security controls are operating as designed • monitors control effectiveness between audits • detects control degradation or drift • feeds evidence directly into GRC platforms for continuous audit readiness.

The rest of this section is part of the full cheat sheet

Table 4: Data Protection Requirements

Data protection requirements define precisely how sensitive data must be handled — from storage and transit to classification, deletion, and cross-border transfer. Getting these wrong is one of the most common sources of GDPR and HIPAA violations.

Requirement	Example	Description
Encryption at Rest	AES-256 encryption for S3 buckets, EBS volumes, RDS databases using CMK	• Data encrypted while stored on disk using symmetric encryption • HIPAA and PCI DSS mandate encryption at rest for sensitive data • most cloud services offer native encryption with CSP-managed or customer-managed keys (CMK).

The rest of this section is part of the full cheat sheet

Table 1: Major Compliance Standards and Regulations

Standard	Example	Description
GDPR (General Data Protection Regulation)	Data processing consent, right to erasure, data portability, breach notification within 72 hours	• EU regulation enforcing data privacy and sovereignty for personal data of EU citizens • applies globally to any organization processing EU data • penalties up to 4% of annual global revenue or €20M • requires data protection impact assessments (DPIAs) for high-risk processing.
HIPAA (Health Insurance Portability and Accountability Act)	MFA everywhere, encryption at rest/in transit, 72-hour data restoration, annual penetration testing	• U.S. healthcare data protection law requiring technical, physical, and administrative safeguards for electronic protected health information (ePHI) • 2026 Security Rule updates mandate MFA, annual pentests, and biannual vulnerability scanning • Business Associate Agreements (BAAs) required for cloud vendors.
PCI DSS (Payment Card Industry Data Security Standard)	PCI DSS 4.0.1: Tokenization, network segmentation, quarterly ASV scans, targeted risk analysis	• Mandates 12 foundational security requirements for any organization that stores, processes, or transmits payment card data • non-compliance fines range $5,000–$100,000/month • v4.0.1 adds targeted risk analysis, enhanced multi-factor requirements, and expanded e-commerce controls.
SOC 2 Type II	6–12 month observation of controls' operational effectiveness against Trust Services Criteria	• Evaluates both design and operating effectiveness of controls over a minimum 6-month period • covers security, availability, confidentiality, processing integrity, and privacy • provides deeper assurance than Type I and is preferred by enterprise customers • requires continuous evidence collection.
ISO 27001	Risk-based ISMS with 93 controls across 4 themes (2022 edition)	• International standard for information security management systems (ISMS) • ISO 27001:2022 restructured controls into Organizational, People, Physical, and Technological themes • certification involves third-party audit and surveillance audits every 1–3 years.
FedRAMP (Federal Risk and Authorization Management Program)	Low, Moderate, High authorization levels based on data sensitivity	• U.S. government cloud security assessment program requiring CSPs to achieve standardized security authorization before handling federal data • built on NIST 800-53 controls • reduces duplicative audits across agencies • FedRAMP 20x modernization (2025) streamlines the authorization process.
NIST Cybersecurity Framework (CSF 2.0)	Govern, Identify, Protect, Detect, Respond, Recover	• Voluntary U.S. framework organizing cybersecurity activities into six functions • CSF 2.0 (2024) adds "Govern" function and emphasizes supply chain risk and organizational accountability • widely adopted for building risk-based security programs across sectors.
DORA (Digital Operational Resilience Act)	EU bank must maintain tested failover for trading systems; document cloud provider contingency plans	• EU regulation effective January 17, 2025 requiring financial entities and their critical ICT providers (including cloud CSPs) to maintain operational resilience • five pillars: ICT risk management, operational continuity, third-party oversight, incident reporting, and information sharing • extraterritorial: applies to non-EU companies providing ICT services to EU financial firms.
NIS2 Directive	EU cloud provider must report major incidents within 24 hours (early warning) and 72 hours (full notification)	• EU cybersecurity law effective October 17, 2024, expanding to 18+ sectors including cloud providers, SaaS, managed services, and healthcare • Essential entities: fines up to €10M or 2% of global revenue; Important entities: €7M or 1.4% • executives personally accountable for cybersecurity governance failures.
CCPA / CPRA (California Consumer Privacy Act / Privacy Rights Act)	Opt-out from data sale, deletion requests, sensitive PI protections, risk assessments	• California privacy law granting consumer data rights similar to GDPR • CPRA amendments require 30-day breach notification, privacy risk assessments, and cybersecurity audits for high-risk businesses • California Privacy Protection Agency (CPPA) actively enforcing.
CMMC (Cybersecurity Maturity Model Certification)	Level 1 (17 practices), Level 2 (110 NIST 800-171 practices), Level 3 (advanced)	• U.S. Department of Defense framework for DIB (Defense Industrial Base) cybersecurity • phased mandatory certification for DoD contractors began November 2025 • enforces NIST 800-171 and 800-172 controls • unannounced assessments allowed for Level 3.
SOC 2 Type I	Point-in-time audit of access controls and encryption design	• Assesses whether security controls are properly designed at a single point in time against TSC • does not test operational effectiveness over time • useful as a first milestone before pursuing Type II.
CSA STAR (Cloud Security Alliance Security Trust Assurance and Risk)	Level 1 (self-assessment), Level 2 (third-party audit), Level 3 (continuous monitoring)	• Three-tier cloud security certification program using the Cloud Controls Matrix (CCM) • Level 2 combines ISO 27001 with CSA-specific controls • publicly listed in CSA STAR Registry for customer due diligence.
CIS Benchmarks	Hardening guides for AWS, Azure, GCP, Kubernetes, Docker, OS	• Prescriptive configuration standards for securing IT systems and cloud platforms • two implementation levels: L1 (basic, low risk), L2 (advanced, higher security) • continuously updated by consensus; CSPM tools map findings to CIS controls automatically.
ISO/IEC 42001 (AI Management System)	AIMS documenting training data provenance, bias testing, human oversight procedures	• First international standard for AI management systems (December 2023) • provides requirements for organizations that develop, provide, or use AI systems • seven pillars: leadership, objectives, AI risk management, data governance, transparency, monitoring, continual improvement • aligns with EU AI Act high-risk obligations due August 2026.
SEC Cybersecurity Disclosure Rules	Publicly traded company files Form 8-K within 4 business days of material breach	• U.S. SEC rules (effective December 2023) requiring public companies to disclose material cybersecurity incidents within four business days • annual Form 10-K disclosure of cybersecurity risk management, strategy, governance, and board oversight • applies to domestic registrants and foreign private issuers.

Table 2: Cloud Governance Frameworks and Policies

Concept	Example	Description
Shared Responsibility Model	CSP secures cloud infrastructure; customer secures data, apps, IAM	• Fundamental division of security ownership in cloud: provider manages "security of the cloud" (physical, network, hypervisor) • customer manages "security in the cloud" (OS, apps, identity, encryption) • obligations shift significantly by service model (IaaS vs. PaaS vs. SaaS).

Table 3: Audit and Attestation Mechanisms

Mechanism	Example	Description
Continuous Control Monitoring (CCM)	Automated daily scans validating MFA enforcement, encryption status, access review completion	• Real-time validation that security controls are operating as designed • monitors control effectiveness between audits • detects control degradation or drift • feeds evidence directly into GRC platforms for continuous audit readiness.

Table 4: Data Protection Requirements

Requirement	Example	Description
Encryption at Rest	AES-256 encryption for S3 buckets, EBS volumes, RDS databases using CMK	• Data encrypted while stored on disk using symmetric encryption • HIPAA and PCI DSS mandate encryption at rest for sensitive data • most cloud services offer native encryption with CSP-managed or customer-managed keys (CMK).