Implementing CCM: Data Protection and Privacy Controls

The Cloud Controls Matrix (CCM) is a framework of essential cloud security controls that follow CSA best practices. You can use CCM to assess and guide the security of any cloud implementation. CCM also provides guidance on which actors within the cloud supply chain should implement which security controls. Both cloud service customers (CSCs) and cloud service providers (CSPs) use CCM in many ways.

CCM contains 197 control objectives structured into 17 domains that cover all key aspects of cloud technology:

CCM Domains

Today we’re looking at implementing the seventh domain of CCM: Data Security and Privacy Lifecycle Management (DSP).

The DSP domain's 19 controls integrate elements of people, process, and technology controls. They ensure that organizations maintain data security and privacy in the cloud throughout the entire data lifecycle. They address critical aspects like data privacy, classification, retention, and disposal. These controls assist both CSPs and CSCs in safeguarding data and ensuring compliance with relevant data protection laws.

 

DSP Shared Responsibilities

The Shared Security Responsibility Model (SSRM) clarifies the division of responsibilities between CSPs and CSCs. It ensures that both parties understand their roles in maintaining security and compliance in the cloud. In relevant cases, the SSRM also specifies when a joint responsibility needs to happen. This helps prevent gaps in security coverage and ensures that someone implements all necessary controls.

In general for the DSP domain, CSPs are responsible for:

• Securing the cloud infrastructure
• Providing capabilities for secure data storage, access, and disposal

CSCs, in turn, are responsible for:

• Securing the data they store or process within the cloud
• Classifying the data
• Leveraging CSP-provided tools like encryption
• Ensuring compliance with data privacy regulations

You can also divide responsibilities by type of cloud model:

• Infrastructure-as-a-Service (IaaS): The CSP is typically responsible for the security of the physical infrastructure. The CSC is responsible for securing the operating systems, applications, and data.
• Platform-as-a-Service (PaaS): The CSP manages the underlying infrastructure and the platform. The CSC focuses on the security of the applications and data that they deploy.
• Software-as-a-Service (SaaS): The CSP handles most security responsibilities, including the application itself. The CSC is primarily responsible for data security and user access management. 

Another important piece of the SSRM is organizational relevance. The CCM ensures that both the CSP and CSC understand their responsibilities based on their roles within the cloud supply chain. 

 

Top Data Security and Privacy Risks

DSP controls help address data breaches, data laws, non-compliance, and privacy violations. They establish safeguards throughout the data lifecycle. They also ensure that sub-processers and third parties have the required minimum security controls.

Additionally, several regulations specify secure retention guidelines and deletion practices. Therefore, the DSP domain shows how to ensure personal data access reversal and deletion, along with other access controls. Regarding data relevance and accuracy, the domain ensures the protection of data in transit, at rest, and in use. These best practices include data masking, encryption, and digital certificates.

The DSP domain also includes privacy procedures for defining roles and mandates. Data is an organizational asset, so its management should include data ownership and data governance. There should be processes to keep inventory current.

Finally, there should be regular audits to ensure compliance with industry standards and international data laws. A key law to keep in mind is the EU's General Data Protection Regulation (GDPR).

 

The Specifics of Each Control

The DSP domain consists of the following 19 controls:

 

Security and Privacy Policy and Procedures

Establish policies for the classification, protection, and handling of data throughout its lifecycle. Consider all applicable laws, regulations, and standards. Review and update the policies at least annually.

Control Ownership: Shared (Independent)

Organizational Relevance: Internal Audit, Architecture Team, GRC Team, Supply Chain Management

Policies should include provisions on the following:

• Scope and objectives (all phases of the data lifecycle, relevant jurisdictions, relevant regulations)
• Data classification (data labeling, asset valuation)
• Data privacy (data minimization, privacy notices)
• Data handling and protection (logical, physical, environmental, and other controls)
• Data storage and retention (data collection, chain of custody)
• Data destruction
• Approval process

 

Secure Disposal

Apply industry-accepted methods for the secure disposal of data from storage media. Ensure that data is not recoverable by any forensic means.

Control Ownership: Shared (Dependent)

Organizational Relevance: Internal Audit, Architecture Team, GRC Team, Supply Chain Management

Recommendations:

• Establish authorization procedures for data disposal requests
• Disallow any new attempts to access data after submitting the request for data deletion
• Prior to physical media disposal, destroy all data stored on such media
• Require a process for verifying the complete destruction of data on decommissioned media
• Use certified data disposal vendors who adhere to industry standards
• Delete data from both active and backup storage media

 

Data Inventory

Create and maintain a data inventory, at least for any sensitive data.

Control Ownership: Shared (Dependent)

Organizational Relevance: Architecture Team, Operations, Legal/Privacy

The data inventory should:

• Explicitly identify the CSC and CSP-derived data
• Provide visibility into the location, volume, and context of sensitive data, especially Personally Identifiable Information (PII) like social security numbers
• Cover structured data, unstructured data, and metadata
• Track data movement as it travels within, across, or outside the organization

 

Data Classification

Classify data according to its type and sensitivity level.

Control Ownership: Shared (Independent) for IaaS, Shared (Dependent) for PaaS and SaaS

Organizational Relevance: Architecture Team, Operations, GRC Team

Recommendations:

• Classify and label data with clear definitions
• Consider tech that either labels data automatically or allows an end user to choose classification
• Consider the protection of data on different types of devices, including endpoints, servers, and mobile devices
• Implement disaster recovery measures for data

 

Data Flow Documentation

Create data flow documentation to identify the location of data processing, storage, and transmission. Review data flow documentation at defined intervals.

Control Ownership: Shared (Independent)

Organizational Relevance: Architecture Team

Data flow documentation should consist of a visual representation of the following:

• Location of sensitive data processing, storage, and transmission
• Sources, destinations, subjects, and objects, and how data moves between them
• Arrows which indicate whether the communication is one way or two way
• Various stages of the data lifecycle

 

Data Ownership and Stewardship

Document ownership and stewardship of all relevant documented personal and sensitive data. Perform a review at least annually.

Control Ownership: Shared (Independent)

Organizational Relevance: Architecture Team, Operations

A data responsibility matrix should include:

• Names or roles of individuals who will act as either owners or stewards of the data
• Clear definitions of the terms data owner, data steward, data consumer, data producer, data protection officer, etc.

 

Data Protection by Design and Default

Develop systems and business practices based upon security by design.

Control Ownership: Shared (Dependent)

Organizational Relevance: Architecture Team, Software Development

Recommendations:

• Complete the data inventory, data classification, asset valuation, and data flow documentation first
• Conduct threat modeling to envision which specific threat actors could attack a specific asset
• Create a comprehensive security pattern that considers threats identified, potential weaknesses, regulations, and countermeasures

In addition, CSCs should:

• Prescribe all security requirements in CSP selection checklists
• Pay special attention to security requirements for scenarios that cover data migration and file uploads/downloads

 

Data Privacy by Design and Default

Develop systems and business practices based upon privacy by design. Configure systems' privacy settings by default and according to all applicable laws and regulations.

Control Ownership: Shared (Dependent)

Organizational Relevance: Architecture Team, Software Development, Legal/Privacy

Recommendations: See the previous control

 

Data Protection Impact Assessment

Conduct a Data Protection Impact Assessment (DPIA). Evaluate the origin, nature, and severity of the risks upon the processing of personal data. Consider any applicable laws and regulations.

Control Ownership: Shared (Dependent)

Organizational Relevance: Architecture Team, Operations, Legal/Privacy

DPIAs should describe the following:

• The nature, scope, context, and purposes of data processing activities
• How to consult with relevant stakeholders
• Compliance and proportionality measures
• Risks and their potential impact to individuals or data subjects
• Measures to reduce or eliminate risks

 

Sensitive Data Transfer

Implement processes and technical measures that protect sensitive data transfers from unauthorized access.

Control Ownership: Shared (Independent)

Organizational Relevance: Cybersecurity, Architecture Team, Operations, GRC Team

Recommendations to the CSP:

• Only store and process data where it is mandated by data protection regulations
• Document security measures involving transfer of sensitive data and data sharing
• If third parties process sensitive information, perform impact assessments

Recommendations to the CSC:

• Ensure the CSP has no insight into the type of content you choose to place into the cloud
• Retain complete control of how you choose to classify, store, and use content
• Implement appropriate safeguards for customers, suppliers, and third parties

 

Personal Data Access, Reversal, Rectification and Deletion

Implement processes to enable data subjects to request access to, modification, or deletion of their personal data.

Control Ownership: Shared (Dependent)

Organizational Relevance: Architecture Team, Operations, Legal/Privacy

Recommendations:

• Establish a process for individual data subjects to have the right of access to their data
• Honor all data subject rights requests
• Govern the process and procedure for requesting access, deletion, and modification of CSC personal data

 

Limitation of Purpose in Personal Data Processing

Process personal data according to the purposes declared to the data subject.

Control Ownership: Shared (Dependent)

Organizational Relevance: Architecture Team, Software Development, Legal/Privacy, GRC Team

Recommendations:

• Establish a formal Data Subject Access Request (DSAR)
• Ensure the legal team monitors regulatory obligations

In addition, CSCs should:

• Implement measures to ensure that the CSP has no insight into what you store in their environment
• Supply the CSP with up-to-date and accurate information
• Implement safeguards to prevent unauthorized access

 

Personal Data Sub-processing

Securely transfer and (sub) process personal data within the service supply chain.

Control Ownership: Shared (Dependent)

Organizational Relevance: Architecture Team, Software Development, Legal/Privacy, GRC Team, Supply Chain Management

Recommendations to the CSP:

• Detail your agreements for the transfer and sub-processing of personal data within the service supply chain
• When engaging any new sub-processor, notify the CSC of the engagement

Recommendations to the CSC:

• Manage the data you place into the CSP’s services

 

Disclosure of Data Sub-processors

Before processing, disclose to the data owner any sensitive data access by sub-processors.

Control Ownership: Shared (Dependent)

Organizational Relevance: Architecture Team, Software Development, Operations, Legal/Privacy, GRC Team, Supply Chain Management

Recommendations:

• Detail the disclosure of any sensitive data by sub-processors
• Ensure processing follows the policies in your data protection addendum
• Disclose the use of subcontractors who may process personal data

 

Limitation of Production Data Use

Obtain authorization from data owners, and manage associated risk, before replicating or using production data in non-production environments.

Control Ownership: Shared (Dependent)

Organizational Relevance: Architecture Team, Software Development, Operations

Recommendations to the CSP:

• Define physical and logical network boundaries
• Enforce change control policies
• Ensure secure software development lifecycle coding practices
• Segregate duties to require business approval to access an environment
• Physically secure datacenters
• Provide periodic awareness training on security and privacy
• Enforce asset inventory tracking and patch management

Recommendations to the CSC:

• Ensure appropriate logging for events such as system errors and data deletions
• Configure service-specific logging features where available
• Transmit secret keys over secure channels
• Ensure TLS connections, integrity validations, and identity checks for networking traffic

 

Data Retention and Deletion

Manage data retention, archiving, and deletion in accordance with business requirements, applicable laws, and regulations.

Control Ownership: Shared (Independent)

Organizational Relevance: Architecture Team, Operations, Legal/Privacy, GRC Team

Recommendations to the CSP:

• Define an information protection policy to set forth the requirements for handling confidential information
• Maintain data retention, archiving, and deletion procedures in accordance with regulations
• Detail agreements for data deletion and data export per applicable laws and regulations
• Review critical system components at least annually
• Destroy defective disks to the point that data is not recoverable
• Promptly comply with written requests to destroy "Maintained Customer Data"

Recommendations to the CSC:

• Schedule and configure data backups manually, as needed
• Maintain all required policies and procedures relevant to your own environment
• Implement a backup and/or replication process in line with your policies
• Enforce your own data retention policies

 

Sensitive Data Protection

Define and implement processes, procedures, and technical measures to protect sensitive data throughout its lifecycle.

Control Ownership: CSP

Organizational Relevance: Architecture Team, Software Development, Operations

Recommendations:

• Publish a privacy statement and explain its processes for handling sensitive data
• Where and when applicable, implement information rights management tech for all sensitive data
• Require a subpoena or its equivalent before disclosing non-content
• Establish a process to capture all law enforcement requests through a secure portal

 

Disclosure Notification

The CSP must describe to CSCs the procedure for disclosure of personal data requests by law enforcement.

Control Ownership: CSP

Organizational Relevance: Legal/Privacy

Recommendations:

• Define a policy for responding to requests for access to confidential information from third parties
• Regularly publish a report about the types and volume of information requests received
• Designate a legal team to maintain appropriate contacts with relevant authorities

 

Data Location

Specify and document the physical locations of data, including where processing and back up take place.

Control Ownership: Shared (Dependent)

Organizational Relevance: Architecture Team, Operations

Recommendations to the CSP:

• Maintain a policy to identify, classify, and record attributes for all assets
• Provide services and tools to help the CSC configure access and logging features
• Audit data centers yearly

Recommendations to the CSC:

• Implement strong encryption processes
• Use Trusted Execution Environments (TEEs) for data in use
• Enable logging features for incident management

 

Start Using the CCM Today

The CCM framework helps organizations:

• Cover all key aspects of cloud technology
• Simplify compliance with mappings to various industry standards
• Identify and manage cloud computing risks 
• Implement and manage security measures consistently
• Ensure that both the CSP and the CSC understand their roles. 
• Show customers their commitment to robust cloud security practices
• Demonstrate compliance and security to both their own stakeholders and to regulators

Download and review the Cloud Controls Matrix and CCM Implementation Guidelines. Explore these free resources and begin to develop successful data security strategies for your organization. Also be on the lookout for the next blog in this ongoing series.