This document outlines the components to include in a 7-12 page final risk assessment and compliance report for moving a company's infrastructure to the cloud. It includes specifying a title page, executive summary of risks and compliance assessment importance, risk analysis with identified risks and management guidelines, potential privacy issues and mitigations, relevant security issues, applicable laws/regulations/frameworks, compliance requirements by geography and industry, and a proposed compliance program. The report aims to convey risks of cloud computing and ensure legal compliance for systems migrating to the cloud.

1. Final Risk Assessment and Compliance Report (seven- to 12-
page report)
This report should include the following components:
· Title Page
· Include: for whom you are preparing the document, the title,
the date prepared, and your name as the preparer of the
document
· Executive Summary
· Include: the purpose of the report, intended audience, and an
explanation of the importance of risk and compliance
assessment in cloud adoption
· Risk Analysis
· Include: written summary of the relevant risks identified, the
Risk Management Matrix (from Steps 1, 4)
· Risk Management Guidelines Used (from Step 2)
· Include: guidelines that are most applicable to this scenario
and why
· Potential Privacy Issues and Mitigation Measures (from Step
3)
· Include: guidelines that are most applicable to this scenario
and why
· Relevant Security Issues (from Step 5)
· Applicable Laws, Regulations, and Frameworks (from Steps 6,
7)
· Compliance Requirements (from Step 8)
· Include:
· geographic-specific compliance requirements for the United
States and European Union
· election industry-specific compliance issues and data
compliance requirements

2. · Proposal for a Compliance Program (from Step 9)
Final Risk Assessment and Compliance Report
(seven
-
to 12
-
page report)
This report should include the following components:
?
Title Page
?
Include: for whom you are preparing the document, the title, the
date prepared, and your name as the preparer of the document
?
Executive Summary
?
Include: the purpose of the report, intended audience, and an
explanation of the importance of risk and complia
nce assessment in cloud
adoption

3. ?
Risk Analysis
?
Include: written summary of the relevant risks identified, the
Risk
Management Matrix (from Steps 1, 4)
?
Risk Management Guidelines Used
(from Step 2)
?
Include:
g
uidelines that are most applicable to this scenario and
why
?
Potential Privacy Issues and Mitigation Measures
(from Step 3)
?
Include:
g
uidelines that are most applicable to this scenario and
why

4. ?
Relevant Security Issues
(from Step 5)
?
Applicable Laws
,
Regulations, and Frameworks
(from
S
teps 6, 7)
?
Compliance Requirements
(from Step 8)
?
Include:
¦
geographic
-
specific compliance requirements for
the United States and European Union
¦
election industry
-
specific compliance issues and

5. data compliance requirements
?
Proposal for a Compliance Program
(
from Step 9)
Final Risk Assessment and Compliance Report (seven- to 12-
page report)
This report should include the following components:
? Title Page
? Include: for whom you are preparing the document, the title,
the
date prepared, and your name as the preparer of the document
? Executive Summary
? Include: the purpose of the report, intended audience, and an
explanation of the importance of risk and compliance
assessment in cloud
adoption
? Risk Analysis
? Include: written summary of the relevant risks identified, the
Risk
Management Matrix (from Steps 1, 4)
? Risk Management Guidelines Used (from Step 2)
? Include: guidelines that are most applicable to this scenario
and
why
? Potential Privacy Issues and Mitigation Measures (from Step
3)
? Include: guidelines that are most applicable to this scenario

6. and
why
? Relevant Security Issues (from Step 5)
? Applicable Laws, Regulations, and Frameworks (from Steps 6,
7)
? Compliance Requirements (from Step 8)
? Include:
¦ geographic-specific compliance requirements for
the United States and European Union
¦ election industry-specific compliance issues and
data compliance requirements
? Proposal for a Compliance Program (from Step 9)
Project 2: Cloud Risk and Compliance Issues Analysis
Start Here
As an IT analyst for BallotOnline, a company providing voting
solutions to a global client base, you are working to convince
the organization to move the current infrastructure to the cloud.
Your supervisor and the director of IT, Sophia, has asked you to
summarize for the company executives the potential risks and
compliance issues that BallotOnline will have to contend with
in the transition to the cloud.
The final report will be seven to 10 pages that convey your
understanding and management of risks associated with cloud
computing, as well as ensuring compliance with legal
requirements involved in moving BallotOnline systems to the
cloud.
This project will take about four weeks. Check the Project 2
FAQ threadin the discussion area for any last-minute update or
clarifications about the project.
Competencies
Your work will be evaluated using the competencies listed
below.

7. · 1.1: Organize document or presentation clearly in a manner
that promotes understanding and meets the requirements of the
assignment.
· 1.2: Develop coherent paragraphs or points so that each is
internally unified and so that each functions as part of the whole
document or presentation.
· 2.1: Identify and clearly explain the issue, question, or
problem under critical consideration.
· 7.1: Examine legal and regulatory requirements.
· 7.2: Examine industry best-practices and standards.
· 8.1: Assess liability issues associated with cloud adoption.
· 8.2: Assess network security and privacy risks associated with
cloud infrastructure.
· 8.3: Assess management and operational risks associated with
cloud.
Step 1: Research Risks Associated With Cloud Adoption
The first step in assessing risk in cloud computing will be to
identify and describe risk concepts and cloud computing risk
factors associated with cloud adoption. As a software as a
service (SaaS) company considering an infrastructure as a
service (IaaS) cloud service provider for your hosting needs,
consider third party outsourcing issues and the generally
accepted best practices for cloud adoption and review
relevant cloud risk case studies. You should also consider best
practices for cloud adoption.
As part of the risk management process, identify and describe
other types of risk, such as risks associated with having
a service-level agreement (SLA). An example of a potential risk
could be if your company is obligated to protect personal
information, and then the cloud provider that you use suffers a
security breach exposing that personal information.
Here, identify and describe other types of risks or potential
liability issues that apply to BallotOnline and discuss them with
your colleagues in the Discussion: Risk forum.
You will incorporate your research into your final report.Step 2:
Identify the Most Appropriate Guidelines for Managing Risks

8. In order to identify guidelines applicable to your company's
industry, you must have an understanding of the different types
of risk management guidelines that exist and are frequently
applicable in cloud environments.
There are several cybersecurity standards applicable to cloud
computing environments such as the NIST Cybersecurity
Framework, ISO standards, and US federal government
standards (DoD/FIPS), as well as several major sets of risk
guidelines for dealing with the risks involved. Also, there are
organizations such as the Cloud Security Alliance (CSA) that
recommend best practices for managing risks.
Review the different guidelines and determine which are most
appropriate for BallotOnline. For example, NIST has
responsibility for developing a number of elections industry
guidelines within the United States.
Identify why those guidelines are most appropriate and compile
these items into a brief (one page or less) recommendation and
justification of your choice. Your recommendation will also be
incorporated into your final report in the final step.
Submit your recommendation to Sophia to review using the
dropbox below.
Step 3: Identify Potential Privacy Issues and Mitigation
Measures
Now that you have identified the guidelines most applicable to
your organization, it is time to discuss privacy protections that
may apply.
BallotOnline is now a global organization and may need to
contend with several sets of privacy laws since these laws vary
from country to country.
Sophia has recommended that you focus on European Union
(EU) privacy requirements for now, including the General Data
Protection Regulation (GDPR), since those are considered to be
the most challenging for compliance. Many companies opt to
host data for their European customers entirely within facilities
in the European Union, and the companies implement
restrictions to prevent data for EU citizens from crossing

9. borders into non-EU zones. This is the approach that you have
been asked to take and where you should focus your efforts.
Note that some cloud providers, such as Amazon, have received
special approval from EU authorities to permit data transfer
outside of the EU.
Research EU privacy requirements, identify the requirements
that apply to your project and why they apply, and compile your
recommendations for complying with these requirements. These
will be incorporated into your final report.
Before moving on to the next step, discuss the material with
your colleagues in the Discussion: Privacy Issues.Step 4: Create
Risk Management Matrix
Now that you have identified and described the types of risks
that may apply to your organization, create a risk management
matrix to assess/analyze that risk and make recommendations
for risk mitigation measures.
This Sample Risk Assessment for Cloud Computing will give
you an example of a completed risk matrix.
Use the risk management matrix template to identify risks and
write a brief summary explaining how to understand the data.
Submit it to Sophia for feedback using the dropbox below.Step
5: Describe Cloud Security Issues
Now that you have completed the risk analysis, you can start to
identify cloud and network security issues that may apply in
BallotOnline's operating environment, including data in transit
vulnerabilities and multifactor authentication.
Consider cloud computing risks, network security
design, information security, data classifications, and identity
management issues. Your findings will be incorporated into
your final report.
Write a short summary about these security issues to submit to
Discussion board: Security Issues forum.Step 6: Examine the
US Legal System and Intellectual Property Laws
Now that you are familiar with security issues, examine and
review the US legal and justice systems. Since BallotOnline is a
software as a service (SaaS) company based in the United States

10. and serving a customer base in the United States, you need to
understand how the legal and justice systems work in the United
States. Your basic understanding of these systems is crucial for
understanding the complexities of the legal system in
cyberspace, where cloud-based systems reside.
As a practitioner working in the cloud computing field, you
should also have an understanding of the complexities
of intellectual property law and cyberspace law, including how
to identify different venues and methods for resolving disputes
(such as the court system, arbitration, mediation), how to define
and negotiate cloud hosting agreements to avoid potential
cyberspace law issues, how to discuss the regulation of
cyberspace, and how to handle electronic agreements and digital
signatures.
To gain a better understanding of how cyberspace laws are
applied to real issues, participate in the analysis of a relevant
legal case with your colleagues in a forum titled Discussion: US
Legal System and Cyberspace Law.
In addition to the discussion board, your findings wil l also be
incorporated into your Final Risk and Compliance Report for
the BallotOnline executives.Step 7: Use Frameworks to Analyze
Complex Legal and Compliance Issues
In the previous step, you examined the US legal and justice
systems as a building block for understanding the complexities
of the legal system in cyberspace, where cloud-based systems
reside.
There are several frameworks for analyzing compliance
issues used to analyze these complex issues. To provide a
manageable set of recommendations to the executives, review
the frameworks and select the one that is most helpful to use for
analyzing these complex issues.Step 8: Analyze General,
Industry, Geographic, Data, and Cloud-Specific Compliance
Issues
In the previous step, you examined the complexities of law in
cyberspace. In this step, you will expand your understanding of
legal and compliance issues related to the cloud by

11. investigating industry-specific compliance issues, geographic-
specific compliance issues such as privacy, and cloud-specific
compliance issues to determine which are applicable to
BallotOnline.
You will also need to analyze data compliance issues applicable
to companies operating in the European Union, including the
recent GDPR regulations, and determine how BallotOnline can
be compliant. The organization is concerned about EU
compliance issues because the laws there are the most
restrictive that BallotOnline will encounter.
Prepare a two- to three-page summary of the data compliance
issues that are applicable to BallotOnline and determine how
BallotOnline can be compliant. This will be part of your final
risk and compliance assessment report.Step 9: Create a Proposal
for a Compliance Program
In previous steps, you have identified potential legal and
compliance requirements that BallotOnline may face in
migrating to a cloud computing model. Now, you need to
determine how BallotOnline can comply with those
requirements.
Create a high-level proposal for a compliance program for
BallotOnline that enables the organization and its employees to
conduct itself in a manner that is in compliance with legal and
regulatory requirements. Management has asked you to model
the proposal on existing compliance programs for other
companies that have migrated to the cloud.
Use the Proposal for Compliance Program template to record
your work and submit for feedback.
Step 10: Write the Final Risk Assessment and Compliance
Report
As you have learned, there are a number of legal and
compliance requirements associated with shifting to a cloud
computing model.
It's time to put everything together in a seven- to 10-page report
for BallotOnline executives: summarizing the risk assessment
and mitigation as well as legal and compliance requirements

12. associated with moving to the cloud, outlining your
recommended action plans for meeting those requirements, and
developing a high-level proposal for a compliance program to
avoid breaches of the requirements.
Use the final risk and compliance report template to complete
your report. When you are finished, submit your work.
Check Your Evaluation Criteria
Before you submit your assignment, review the competencies
below, which your instructor will use to evaluate your work. A
good practice would be to use each competency as a self-check
to confirm you have incorporated all of them. To view the
complete grading rubric, click My Tools, select Assignments
from the drop-down menu, and then click the project title.
· 1.1: Organize document or presentation clearly in a manner
that promotes understanding and meets the requirements of the
assignment.
· 1.2: Develop coherent paragraphs or points so that each is
internally unified and so that each functions as part of the whole
document or presentation.
· 2.1: Identify and clearly explain the issue, question, or
problem under critical consideration.
· 7.1: Examine legal and regulatory requirements.
· 7.2: Examine industry best-practices and standards.
· 8.1: Assess liability issues associated with cloud adoption.
· 8.2: Assess network security and privacy risks associated with
cloud infrastructure.
· 8.3: Assess management and operational risks associated with
cloud.