Cloud Computing Risks and Controls for the CPA BAR Exam
Master cloud computing concepts for the CPA BAR section. Covers IaaS, PaaS, SaaS deployment models, security risks, vendor management, and compliance considerations.
Cloud Computing Overview
Cloud computing delivers computing resources (servers, storage, databases, networking, software, and analytics) over the internet on a pay-as-you-go basis. For the CPA BAR exam, you need to understand the different service models, deployment models, associated risks, and the controls that mitigate those risks. Cloud computing has transformed how organizations manage their IT infrastructure and has significant implications for data security, compliance, and financial reporting.
Service Models
Infrastructure as a Service (IaaS)
IaaS provides virtualized computing resources over the internet. The cloud provider manages the physical hardware, while the customer manages the operating system, middleware, applications, and data. Examples include virtual servers, storage, and networking. The customer has the most control but also the most responsibility for security and configuration. IaaS is similar to renting raw computing power.
Platform as a Service (PaaS)
PaaS provides a platform for developing, testing, and deploying applications without managing the underlying infrastructure. The cloud provider manages hardware, operating systems, and middleware, while the customer manages applications and data. PaaS is useful for development teams that want to focus on writing code rather than managing servers.
Software as a Service (SaaS)
SaaS delivers complete applications over the internet, typically accessed through a web browser. The cloud provider manages everything from infrastructure to the application itself. The customer manages only user access and data. Many modern accounting and ERP systems are delivered as SaaS, including QuickBooks Online, NetSuite, and Workday. SaaS offers the least control but also the least management burden.
Deployment Models
Public cloud resources are shared among multiple customers (tenants) and managed by a third-party provider. Private cloud resources are dedicated to a single organization, offering greater control and security. Hybrid cloud combines public and private cloud resources, allowing organizations to keep sensitive data in a private cloud while using public cloud for less sensitive workloads. Community cloud resources are shared among organizations with common concerns, such as regulatory requirements.
Cloud Computing Risks
Data Security and Privacy
Storing data in the cloud raises concerns about unauthorized access, data breaches, and data loss. In a multi-tenant environment, the risk of data leakage between tenants must be addressed through strong isolation controls. Encryption of data in transit and at rest is essential. The organization must also consider the physical location of data, as data stored in other countries may be subject to different privacy laws and government access requests.
Vendor Lock-In
Dependence on a single cloud provider can make it difficult and costly to switch to another provider or bring services back in-house. Proprietary formats, APIs, and tools can create barriers to migration. Organizations should consider data portability and interoperability when selecting cloud providers and negotiating contracts.
Service Availability
Organizations rely on the cloud provider for system availability. Service outages can disrupt business operations and affect the ability to process transactions and generate financial reports. Service level agreements (SLAs) should specify uptime guarantees, response times, and remedies for service failures. Organizations should also maintain business continuity plans for cloud service disruptions.
Compliance and Regulatory Risks
Organizations remain responsible for regulatory compliance even when using cloud services. Financial data stored in the cloud must still comply with regulations such as SOX, GDPR, HIPAA, and industry-specific requirements. The organization must ensure the cloud provider's controls are adequate and may need to obtain a SOC report (Service Organization Control report) to assess the provider's control environment.
Cloud Security Controls
Key controls for managing cloud computing risks include conducting thorough due diligence before selecting a provider, negotiating detailed SLAs with security and availability requirements, implementing strong identity and access management (including multi-factor authentication), encrypting sensitive data both in transit and at rest, maintaining regular backups independent of the cloud provider, monitoring cloud activity and reviewing access logs, and obtaining and reviewing SOC reports from the provider.
The Shared Responsibility Model
Cloud security follows a shared responsibility model. The cloud provider is responsible for security of the cloud (physical infrastructure, hypervisors, networking), while the customer is responsible for security in the cloud (data classification, access management, application security, and compliance). The division of responsibility varies by service model, with IaaS placing the most responsibility on the customer and SaaS placing the most on the provider.
Exam Preparation Tips
- Know the three cloud service models (IaaS, PaaS, SaaS) and the four deployment models.
- Understand the shared responsibility model and how responsibility shifts across service models.
- Be familiar with key cloud risks: data security, vendor lock-in, availability, and compliance.
- Know the role of SOC reports in evaluating cloud provider controls.
- Understand why organizations remain responsible for compliance regardless of where data is hosted.
Practice What You Learned
Study with 1,200+ flashcards and 140 practice exams across all 4 CPA sections.