Integrated Capstone — Cloud Customer Analytics
Situation
A company launches customer analytics using an external cloud vendor. The data includes PII, payment-card fields, purchase history, and internal pricing strategy. Analysts need broad trend access; service agents need customer-level verification; developers need realistic non-production data; the vendor needs operational access; auditors require compliance evidence.
Current design weaknesses:
- one shared vendor administrator account;
- a full Production copy in Test;
- no centralized classification Metadata.
Your task
Redesign the Chapter 7 control system in order. Address:
- confidentiality and regulatory classification;
- Metadata and sensitive-data location;
- role/entitlement design;
- masking/encryption;
- service/shared account controls;
- monitoring and audit evidence;
- outsourcing/cloud custody and contract controls;
- actionable metrics.
Answer framework
- Inventory/classify: identify sensitive fields, one confidentiality level, and all applicable regulatory/contract categories.
- Record Metadata: document classifications and locations so protection follows the data.
- Design roles/entitlements: separate analyst, service-agent, developer, vendor, and auditor needs; grant least privilege.
- Protect non-production: remove unnecessary sensitive fields or use Persistent masking; preserve key relationships when testing requires them.
- Govern privileged/vendor IDs: replace unsafe generic human access; constrain service accounts; document approvals; preserve traceability.
- Add monitoring/evidence: detect unusual access, retain protected logs, separate formal audit duties, prove prerequisites/approvals.
- Contract for cloud custody: define SLA, chain of custody, CRUD/RACI/shared responsibilities, right-to-audit, reporting, consequences.
- Measure: baseline actionable Implementation, Awareness, Protection, Incident, and Proliferation measures.
Quality rule
A strong answer does not merely name controls. It connects every control to a business/regulatory requirement and explains who approves, enforces, monitors, and audits it.
Changed fact
If the platform contained only public/non-sensitive data with no regulatory/contract restrictions, controls should become proportionate. Chapter 7 does not say to preserve every high-security control regardless of business need.