When to Use
- Scope cloud workloads for SOC 2, ISO 27001, HIPAA, PCI, FedRAMP, or regional privacy rules
- Map framework controls to cloud-native evidence (Config, org trails, IAM reports, KMS)
- Build evidence collectors from cloud APIs and central log archive
- Prepare auditor walkthroughs for multi-account landing zones and SaaS on IaaS/PaaS
- Respond to customer security questionnaires with cloud control proof
- Design continuous cloud compliance dashboards (CIS conformance, posture rules)
- Document data residency — regions, replication, cross-border transfers (technical facts)
- Track cloud gap remediation before observation period or assessor visit
- Interpret provider shared responsibility and inheritance in audit narratives
When NOT to Use
- Enterprise-wide GRC program, policies, audit prep (non-cloud) →
compliance-specialist - Org-wide technical evidence automation →
compliance-engineer - Implement SCPs, IAM hardening, CSPM rules →
cloud-security-engineer - Landing zone architecture without compliance lens →
cloud-architect,enterprise-cloud-architect - Cloud program strategy and migration portfolio governance →
vp-of-cloud - Legal advice, DPAs, regulatory interpretation →
commercial-counsel,corporate-counsel - SOX financial controls and journal testing →
senior-revenue-accountant - Pipeline SAST/SBOM configuration →
devsecops - AI model regulatory classification →
ai-risk-governance
Related skills
| Need | Skill |
|---|---|
| VP cloud program and regulated placement themes | vp-of-cloud |
| GRC program, scope, gap plans, audit coordination | compliance-specialist |
| Cross-domain compliance and evidence automation | compliance-engineer |
| Cloud security control implementation | cloud-security-engineer |
| Enterprise cloud governance and CCoE | enterprise-cloud-architect |
| Cloud reference architecture | cloud-architect |
| Security program strategy | cybersecurity |
| Pipeline and SSDF evidence | devsecops |
| Data governance and privacy architecture | data-architect |
| Physical DC compliance evidence | data-center-design-execution-lead |
| FinOps spend analysis | finops-analyst |
| GL mapping and invoice reconciliation | compute-accounting-manager |
| Security risk registers and third-party risk tiers | security-risk-analyst |
Core Workflows
1. Scope and shared responsibility
Cloud in-scope boundaries and provider vs customer duties for audits.
See references/cloud_compliance_scope.md.
2. Framework mapping in cloud
SOC 2, ISO, HIPAA, PCI, FedRAMP control patterns on cloud.
See references/framework_cloud_mapping.md.
3. Cloud evidence collection
API sources, samples, retention for assessors.
See references/cloud_evidence_collection.md.
4. Residency and sovereignty
Regions, replication, cross-border technical documentation.
See references/residency_sovereignty.md.
5. Continuous cloud monitoring
CSPM, Config rules, drift and exceptions.
See references/continuous_cloud_monitoring.md.
6. Audit readiness and customer assurance
Walkthroughs, CAIQ/SIG, gap closure.
See references/audit_readiness_cloud.md.
Outputs
- Cloud compliance scope memo — accounts, services, data classes, inherited controls
- Control-to-evidence matrix — framework ID, cloud check, source, cadence, owner
- Evidence package — exports with timestamps and population notes
- Residency diagram — regions, backups, DR, subprocessors (technical)
- CCM dashboard spec — rules, thresholds, exception register
- Assessor FAQ — shared responsibility, logging, encryption, access
Principles
- Inherit explicitly — document what the hyperscaler attests vs what you must prove
- Evidence from systems of record — APIs and logs, not screenshots alone
- Scope narrow — exclude out-of-scope accounts and legacy unless required
- Continuous over point-in-time — drift detection before the auditor finds it
- Partner with security — compliance defines what;
cloud-security-engineerimplements how