What this control covers
Defines contractual terms for data provision upon termination, specifying type, format, timeframe, and deletion obligations. Aligns with customer needs and legal requirements, ensuring secure and timely data return to cloud customers.
Why it matters
A well-architected cloud landing zone bakes most of these controls in at the platform layer — done well, individual workloads inherit security for free.
How to implement
AWS
Segment workloads into separate VPCs/accounts per environment. Use security groups as stateful allow-lists (least-port, source by SG ID not 0.0.0.0/0) and VPC Flow Logs to CloudWatch/S3. Front public services with AWS WAF + Shield Advanced and use PrivateLink/VPC Endpoints to keep service traffic off the internet.
Azure
Use Network Security Groups and Application Security Groups for east-west, and an Azure Firewall or NVA in a hub VNet for north-south. Enforce Private Endpoints for PaaS and turn on Defender for Cloud — Network for adaptive hardening recommendations.
GCP
Use VPC Service Controls to draw a perimeter around sensitive APIs and a hierarchical Firewall policy at the org/folder level so projects inherit a deny-by-default posture. Front HTTP workloads with the global Cloud Load Balancer + Cloud Armor.
Evidence to collect
infra_scan— See the iCompaas Evidence library for the canonical source for this evidence type.
Infrastructure posture tooling (AWS Config, Azure Policy, Nessus) verifies platform hardening. Focus: Contractual agreements for the provision of data.
Quick checklist
- Interfaces — Agreements / - Configuration
- Security — Agreements / - Configuration
- Data — Agreements / - Configuration
- Secure — Agreements / - Configuration
- Contractual — Agreements / - Configuration
- Legal — Agreements / - Configuration
Related articles on this site
- Microsoft Cloud Security Posture Management (CSPM)
- Ensure that encryption at rest is enabled for Amazon Athena query results stored in Amazon S3 in order to secure data and meet compliance requirements for data-at-rest encryption.
- Ensure EBS Volumes Attached to an EC2 Instance Are Marked for Deletion Upon Instance Termination
- Enable Transparent Data Encryption with Customer-Managed Keys on Azure SQL Servers for Enhanced Data Security