As an IT analyst for Ballot a company providing.docx
1. As an IT analyst for Ballot Online, a company providing
As an IT analyst for Ballot Online, a company providing voting solutions to a global client
base, you are working to convince the organization to move the current infrastructure to
the cloud.Your supervisor and the director of IT, Sophia, has asked you to summarize for the
company executives the potential risks and compliance issues that Ballot Online will have to
contend with in the transition to the cloud.The final report will be seven to 10 pages that
convey your understanding and management of risks associated with cloud computing, as
well as ensuring compliance with legal requirements involved in moving BallotOnline
systems to the cloud.Step 1: Research Risks Associated With Cloud AdoptionThe first step in
assessing risk in cloud computing will be to identify and describe risk concepts and cloud
computing risk factors associated with cloud adoption. As a software as a service (SaaS)
company considering an infrastructure as a service (IaaS) cloud service provider for your
hosting needs, consider third party outsourcing issues and the generally accepted best
practices for cloud adoption and review relevant cloud risk case studies. You should also
consider best practices for cloud adoption.As part of the risk management process, identify
and describe other types of risk, such as risks associated with having a service-level
agreement (SLA). An example of a potential risk could be if your company is obligated to
protect personal information, and then the cloud provider that you use suffers a security
breach exposing that personal information.Here, identify and describe other types of risks
or potential liability issues that apply to BallotOnline.Step 2: Identify the Most Appropriate
Guidelines for Managing RisksIn order to identify guidelines applicable to your company’s
industry, you must have an understanding of the different types of risk management
guidelines that exist and are frequently applicable in cloud environments.There are several
cybersecurity standards applicable to cloud computing environments such as the NIST
Cybersecurity Framework, ISO standards, and US federal government standards
(DoD/FIPS), as well as several major sets of risk guidelines for dealing with the risks
involved. Also, there are organizations such as the Cloud Security Alliance (CSA) that
recommend best practices for managing risks.Review the different guidelines and
determine which are most appropriate for BallotOnline. For example, NIST has
responsibility for developing a number of elections industry guidelines within the United
States.Identify why those guidelines are most appropriate and compile these items into a
brief (one page or less) recommendation and justification of your choice. Your
recommendation will also be incorporated into your final report in the final step.Submit
your recommendation to Sophia to review before you present your final work.Step 3:
2. Identify Potential Privacy Issues and Mitigation MeasuresNow that you have identified the
guidelines most applicable to your organization, it is time to discuss privacy protections
that may apply.BallotOnline is now a global organization and may need to contend with
several sets of privacy laws since these laws vary from country to country.Sophia has
recommended that you focus on European Union (EU) privacy requirements for now,
including the General Data Protection Regulation (GDPR), since those are considered to be
the most challenging for compliance. Many companies opt to host data for their European
customers entirely within facilities in the European Union, and the companies implement
restrictions to prevent data for EU citizens from crossing borders into non-EU zones. This is
the approach that you have been asked to take and where you should focus your efforts.
Note that some cloud providers, such as Amazon, have received special approval from EU
authorities to permit data transfer outside of the EU.Research EU privacy requirements,
identify the requirements that apply to your project, and why they apply and compile your
recommendations for complying with these requirements. These will be incorporated into
your final report.Before moving on to the next step, discuss privacy issues in one page or
less, and submit it separately before you submit your final work.Step 4: Create Risk
Management MatrixNow that you have identified and described the types of risks that may
apply to your organization, create a risk management matrix to assess/analyze that risk,
and make recommendations for risk mitigation measures.This Sample Risk Assessment for
Cloud Computing will give you an example of a completed risk matrix.Use the risk
management matrix template to identify risks and write a brief summary explaining how to
understand the data. Submit it to Sophia for feedback before you present your final
work.Step 5: Describe Cloud Security IssuesNow that you have completed the risk analysis,
you can start to identify cloud and network security issues that may apply in BallotOnline’s
operating environment, including data in transit vulnerabilities and multifactor
authentication.Consider cloud computing risks, network security design, information
security, data classifications, and identity management issues. Your findings will be
incorporated into your final report.Discuss these security issues in one page or less, and
submit it separately before you submit your final work.Step 6: Examine the US Legal System
and Intellectual Property LawsNow that you are familiar with security issues, examine and
review the US legal and justice systems. Since BallotOnline is a software as a service (SaaS)
company based in the United States and serving a customer base in the United States, you
need to understand how the legal and justice systems work in the United States. Your basic
understanding of these systems is crucial for understanding the complexities of the legal
system in cyberspace, where cloud-based systems reside.As a practitioner working in the
cloud computing field, you should also have an understanding of the complexities of
intellectual property law and cyberspace law, including how to identify different venues and
methods for resolving disputes (such as the court system, arbitration, mediation), how to
define and negotiate cloud hosting agreements to avoid potential cyberspace law issues,
how to discuss the regulation of cyberspace, and how to handle electronic agreements and
digital signatures.To gain a better understanding of how cyberspace laws are applied to real
issues, participate in the analysis of a relevant legal case with your colleagues in a forum
titled Discussion: US Legal System and Cyberspace Law.In addition to the discussion board,
3. your findings will also be incorporated into your Final Risk and Compliance Report for the
BallotOnline executives.Step 7: Use Frameworks to Analyze Complex Legal and Compliance
IssuesIn the previous step, you examined the US legal and justice systems as a building
block for understanding the complexities of the legal system in cyberspace, where cloud-
based systems reside.There are several frameworks for analyzing compliance issues used to
analyze these complex issues. To provide a manageable set of recommendations to the
executives, review the frameworks and select the one that is most helpful to use for
analyzing these complex issues.Step 8: Analyze General, Industry, Geographic, Data, and
Cloud-Specific Compliance IssuesIn the previous step, you examined the complexities of law
in cyberspace. In this step, you will expand your understanding of legal and compliance
issues related to the cloud by investigating industry-specific compliance issues, geographic-
specific compliance issues such as privacy, and cloud-specific compliance issues to
determine which are applicable to BallotOnline.You will also need to analyze data
compliance issues applicable to companies operating in the European Union, including the
recent GDPR regulations, and determine how BallotOnline can be compliant. The
organization is concerned about EU compliance issues because the laws there are the most
restrictive that BallotOnline will encounter.Prepare a two- to three-page summary of the
data compliance issues that are applicable to BallotOnline and determine how BallotOnline
can be compliant. This will be part of your final risk and compliance assessment report.Step
9: Create a Proposal for a Compliance ProgramIn previous steps, you have identified
potential legal and compliance requirements that BallotOnline may face in migrating to a
cloud computing model. Now, you need to determine how BallotOnline can comply with
those requirements.Create a high-level proposal for a compliance program for BallotOnline
that enables the organization and its employees to conduct itself in a manner that is in
compliance with legal and regulatory requirements. Management has asked you to model
the proposal on existing compliance programs for other companies that have migrated to
the cloud.Use the Proposal for Compliance Program template to record your work and
upload it to the class folder for feedback before you submit your final work.Step 10: Write
the Final Risk Assessment and Compliance ReportAs you have learned, there are a number
of legal and compliance requirements associated with shifting to a cloud computing
model.It’s time to put everything together in a seven- to 10-page report for BallotOnline
executives: summarizing the risk assessment and mitigation as well as legal and compliance
requirements associated with moving to the cloud, outlining your recommended action
plans for meeting those requirements, and developing a high-level proposal for a
compliance program to avoid breaches of the requirements.Use the final risk and
compliance report template to complete your report.Use the following criteria to respond to
the questions.1.1: Organize document or presentation clearly in a manner that promotes
understanding and meets the requirements of the assignment.1.2: Develop coherent
paragraphs or points so that each is internally unified and so that each functions as part of
the whole document or presentation.2.1: Identify and clearly explain the issue, question, or
problem under critical consideration.7.1: Examine legal and regulatory requirements.7.2:
Examine industry best-practices and standards.8.1: Assess liability issues associated with
cloud adoption.8.2: Assess network security and privacy risks associated with cloud
