The policy name includes “secure”.
Cloud / 06
Cloud and SaaS review
Test shared responsibility against actual settings, data paths and recovery evidence.
This work is currently open on this device. Sign in to save it and continue on another device.
Sign inProvider security capabilities and customer configuration are different. Review tenant boundaries, administrative identities, external sharing, log coverage and recovery together. Controls may require particular licences or service tiers; verify the product and contract rather than assuming availability.
Map the process
0 / 4 steps reviewed.Step 1 / 4
Allocate responsibility
Record provider/customer responsibilities for data, identity, infrastructure and application. Explain “provider-managed” by service layer and assign any gaps.
Expected evidence
Service-specific responsibility matrix
One control, three perspectives
Which setting is actually effective?
Run an authorized resource-level negative test.
Effective configuration and test resultEvaluate evidence
Claim: External sharing is restricted.
What evidence would you request before closing this claim?
Decision desk
A central policy is enabled, but a project can create anonymous links.
How do you proceed?
Worked example
This record is fictional. Do not treat sample results as evidence for your own work.
| Resource | Owner | Expected control | Effective setting | Test | Action |
|---|---|---|---|---|---|
| Example project | Cloud service owner | No anonymous sharing | Legacy-link exception | Synthetic guest test | Remove old link and verify |
Closure checklist
0 / 4Checks on this screen last for this session only; they do not create closure evidence or compliance approval. Keep organizational records in the downloaded workpaper.
Take it to work
Files in the selected language. The workbook includes blank records, a worked example and a checklist.
Keep learning
Explore related Academy coursesSources and edition
Checked: 2026-10-21 · Edition 2026.10