CISM: Certified Information Security ManagerDemo

Before a cloud provider can be properly assessed, before SLAs can be meaningfully evaluated, and before implementation costs can be estimated, the organization must first define what security controls and protections it requires. The information security manager's most important contribution to a cloud migration is establishing and communicating the security requirements (e.g., data protection, access control, compliance, encryption, incident response expectations) that the cloud solution and provider must satisfy. These requirements then serve as the baseline for reviewing provider assessment reports and evaluating SLAs, making requirement-setting the foundational and most critical step in supporting a secure migration.