A financial company has decided to move its main business application to the Cloud. The legal department objects, arguing that the move of the platform should comply with several regulatory obligations such as the General Data Protection (GDPR) and ensure data confidentiality. The Chief Information Security Officer (CISO) says that the cloud provider has met all regulations requirements and even provides its own encryption solution with internally-managed encryption keys to address data confidentiality. Did the CISO address all the legal requirements in this situation?

Question

Quizplus · Accepted Answer

The CISO did not fully address the legal requirements because using internally-managed encryption keys by the cloud provider may not satisfy data confidentiality concerns, as the keys are not controlled by the company itself.

A Financial Company Has Decided to Move Its Main Business