2 cissp ® Official Study Guide Eighth Edition

Managing Cloud-Based Assets
Cloud-based assets include any resources that an organization accesses using cloud comput-
ing. Cloud computing refers to on-demand access to computing resources available from 
almost anywhere, and cloud computing resources are highly available and easily scalable. 
Organizations typically lease cloud-based resources from outside the organization, but they 
can also host on-premises resources within the organization. One of the primary challenges 
with cloud-based resources hosted outside the organization is that they are outside the 
direct control of an organization, making it more difficult to manage the risk.
Some cloud-based services only provide data storage and access. When storing data in 
the cloud, organizations must ensure that security controls are in place to prevent unau-
thorized access to the data. Additionally, organizations should formally define requirements 
to store and process data stored in the cloud. As an example, the Department of Defense 
(DoD) Cloud Computing Security Requirements Guide defines specific requirements for 
U.S. government agencies to follow when evaluating the use of cloud computing assets. 
This document identifies computing requirements for assets labeled Secret and below using 
six separate information impact levels.
There are varying levels of responsibility for assets depending on the service model. This 
includes maintaining the assets, ensuring that they remain functional, and keeping the systems 
and applications up-to-date with current patches. In some cases, the cloud service provider 
(CSP) is responsible for these steps. In other cases, the consumer is responsible for these steps.
Software as a service (SaaS) Software as a service (SaaS)
models provide fully functional 
applications typically accessible via a web browser. For example, Google’s Gmail is a SaaS 
application. The CSP (Google in this example) is responsible for all maintenance of the 
SaaS services. Consumers do not manage or control any of the cloud-based assets.