Legal, Risk and Compliance

A company adopts a SaaS payroll platform. The provider processes employee personal data strictly on the company's documented instructions and does not decide the purposes of processing. Under data protection principles, how are the two parties best classified?

• ABoth the company and the SaaS provider are joint controllers because they share access to the same personal data.
• BThe company is the data controller and the SaaS provider is the data processor.check_circle Correct
• CThe SaaS provider is the data controller and the company is the data processor acting on its behalf.
• DThe SaaS provider is a sub-processor and the company is an unrelated third party to the processing.

Why A is wrong: Shared access alone does not create joint control; joint controllers must together determine the purposes and means, which the provider here does not.

Why B is correct: Correct. The company decides the purposes and means, making it the controller, while the provider acting only on documented instructions is the processor.

Why C is wrong: This reverses the roles; the party that determines purposes is the controller, and here that is the customer, not the provider.

Why D is wrong: A sub-processor is engaged by a processor, and the customer is a party to the processing as controller, so neither label fits this direct relationship.

A cloud customer facing litigation needs an international standard to structure how electronically stored information held by its provider is identified, preserved and produced. Which statement most accurately describes ISO/IEC 27050?

• AIt defines the cloud-specific security controls that providers and customers implement under a shared responsibility model.
• BIt specifies how personally identifiable information is protected by processors acting as PII handlers in public clouds.
• CIt sets the mandatory breach notification timelines a provider must meet after detecting a security incident.
• DIt provides guidance on electronic discovery, including the identification, preservation, collection and production of electronically stored information.check_circle Correct

Why A is wrong: Tempting because it is a cloud-relevant ISO/IEC standard, but this describes ISO/IEC 27017, not the eDiscovery standard.

Why B is wrong: This describes ISO/IEC 27018 on PII protection in public clouds, which is a different standard focused on privacy, not discovery.

Why C is wrong: Breach notification timelines come from data protection law and contracts, not from the ISO/IEC 27050 eDiscovery guidance.

Why D is correct: Correct. ISO/IEC 27050 addresses electronic discovery processes, giving a common framework for handling electronically stored information across custodians and providers.

A cloud customer receives a provider's SOC 2 report covering a six-month window and confirming that the design of controls was suitable and that each control operated effectively throughout that period. Which report type has the customer received?

• ASOC 2 Type I, because it attests to the operating effectiveness of controls across a defined period
• BSOC 2 Type II, because it attests to the operating effectiveness of controls across a defined periodcheck_circle Correct
• CSOC 1 Type II, because it reports on controls relevant to security, availability and confidentiality
• DSOC 3, because it provides a period-based general-use summary suitable for public distribution

Why A is wrong: A Type I report is tempting because it is also a SOC 2 engagement, but it assesses design at a single point in time and does not test operating effectiveness over a period.

Why B is correct: A Type II report evaluates both suitability of design and operating effectiveness over a stated period, which matches the six-month window and effective operation described.

Why C is wrong: SOC 1 is tempting because it also has a Type II variant, but SOC 1 addresses controls over financial reporting, not the trust services criteria described here.

Why D is wrong: SOC 3 is tempting because it draws on the same examination, but it is a short general-use report without the detailed control tests and results a customer would receive here.

During planning for a cloud certification audit, the lead auditor must document which systems, locations, processes and time period the engagement will examine, and record any customer-managed components that are excluded. Which artefact captures these boundaries?

• AThe audit scope statement, which defines the systems, locations, processes, period and exclusions the engagement will examinecheck_circle Correct
• BThe information security management system policy, which sets the organisation's overall security objectives and governance
• CThe statement of applicability, which lists the controls selected as relevant and justifies any that are excluded
• DThe management representation letter, which records management's formal assertions to the auditor at the close of fieldwork

Why A is correct: Fixing the systems, sites, processes, time period and exclusions of an engagement is exactly what an audit scope statement is written to do.

Why B is wrong: The ISMS policy is tempting because it governs the environment being audited, but it states security intent rather than defining what a specific audit engagement will cover.

Why C is wrong: The statement of applicability is tempting because it also records exclusions, but it concerns control selection under a standard, not the boundaries of an audit engagement.

Why D is wrong: A representation letter is tempting as an audit document, but it captures management's assertions near the end rather than defining the engagement's boundaries during planning.

A retailer moves its payment platform to a public cloud and implements tokenisation, network segmentation and continuous monitoring. When the risk team measures the exposure that remains after these controls are operating, which type of risk are they quantifying?

• AInherent risk, because the platform still processes cardholder data regardless of the controls applied
• BResidual risk, the exposure that remains after the selected controls have reduced the inherent riskcheck_circle Correct
• CTransferred risk, because moving to a public cloud shifts the exposure to the cloud service provider
• DSecondary risk, the new exposure introduced by the tokenisation and segmentation controls themselves

Why A is wrong: Inherent risk is the exposure before any controls are considered; measuring what is left after controls are operating is a different quantity, so this mislabels the value.

Why B is correct: Residual risk is precisely the exposure left once controls are applied to inherent risk, which is what the team is measuring.

Why C is wrong: Using a provider does not transfer accountability for the risk, and the term describes a treatment choice rather than the leftover exposure being measured here.

Why D is wrong: Secondary risk is a fresh risk created by a control, not the general leftover exposure after treatment, so it names a narrower and different concept.