[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-seo-171378-105":3,"detail-sidebar-cat-1-en-105":81,"doc-detail-171378-en":126},{"code":4,"msg":5,"data":6},0,"ok",{"site_id":7,"language":8,"slug":9,"title":10,"keywords":11,"description":12,"schema_data":13,"social_meta":74,"head_meta":76,"extra_data":78,"updated_unix":80},105,"en","cloud-computing-data-security-and-privacy-lifecycle-management-dsp-internal-audit-practice-aid","Cloud Computing - Data Security and Privacy Lifecycle Management (DSP) Internal Audit Practice Aid","","Cloud services increasingly support Transportation Agencies by enabling scalable, cost-efficient digitalization with improved agility, reliability, and continuity. This practice aid helps auditors assess whether internal controls provide adequate assurance for Data Security and Privacy (DSP) processes. It uses the Cloud Security Alliance (CSA) Cloud Control Matrix (CCM) version 4.0.3 and guides alignment with relevant statutes and regulations. The engagement scope reviews controls and the audit objectives test implementation of core DSP components across policy, disposal, inventory, classification, documentation, ownership, protection by design, DPIA, secure transfer, and data subject access.",{"@graph":14,"@context":73},[15,34,56],{"@type":16,"itemListElement":17},"BreadcrumbList",[18,23,27,31],{"item":19,"name":20,"@type":21,"position":22},"https://docshare.wps.com","Home","ListItem",1,{"item":24,"name":25,"@type":21,"position":26},"https://docshare.wps.com/template/","Template",2,{"item":28,"name":29,"@type":21,"position":30},"https://docshare.wps.com/template/presentations/","Presentations",3,{"item":32,"name":10,"@type":21,"position":33},"https://docshare.wps.com/template/cloud-computing-data-security-and-privacy-lifecycle-management-dsp-internal-audit-practice-aid/171378/",4,{"url":32,"name":10,"@type":35,"image":36,"author":41,"headline":10,"publisher":44,"fileFormat":47,"inLanguage":8,"description":12,"dateModified":48,"datePublished":49,"encodingFormat":47,"isAccessibleForFree":50,"interactionStatistic":51},"DigitalDocument",{"url":37,"@type":38,"width":39,"height":40},"https://docshare.wps.com/thumbnails/cloud-computing-data-security-and-privacy-lifecycle-management-dsp-internal-audit-practice-aid/171378.png","ImageObject",442,249,{"name":42,"@type":43},"Theodore","Person",{"url":19,"name":45,"@type":46},"DocShare","Organization","application/vnd.openxmlformats-officedocument.wordprocessingml.document","2026-10-19","2026-09-01",true,{"@type":52,"interactionType":53,"userInteractionCount":55},"InteractionCounter",{"@type":54},"ViewAction",14,{"@type":57,"mainEntity":58},"FAQPage",[59,65,69],{"name":60,"@type":61,"acceptedAnswer":62},"What is the purpose of this Internal Audit Practice Aid for DSP?","Question",{"text":63,"@type":64},"It assists auditors in developing testing to provide assurance that Transportation Agencies’ Data Security and Privacy (DSP) processes contain adequate controls.","Answer",{"name":66,"@type":61,"acceptedAnswer":67},"Which frameworks does the practice aid rely on?",{"text":68,"@type":64},"It relies on the Cloud Security Alliance (CSA) Cloud Control Matrix (CCM) version 4.0.3, including implementation and auditing guidelines.",{"name":70,"@type":61,"acceptedAnswer":71},"What categories of DSP controls are covered by the audit objectives?",{"text":72,"@type":64},"The objectives cover policy and procedures, secure disposal, data inventory and classification, data flow documentation, ownership and stewardship, protection by design and default, privacy by design and default, DPIA, secure transfer, and data subject access rights.","https://schema.org",{"og:url":32,"og:type":75,"og:title":10,"og:site_name":45,"og:description":12},"article",{"robots":77,"canonical":32},"index,follow",{"doc_id":79,"site_id":7},171378,1791692865,{"code":4,"msg":82,"data":83},"success",[84,88,93,97,102,107,112,117,122],{"id":85,"doc_module":22,"doc_module_name":25,"category_name":29,"show_sort_weight":86,"slug":87},11,90,"presentations",{"id":89,"doc_module":22,"doc_module_name":25,"category_name":90,"show_sort_weight":91,"slug":92},12,"Resumes",80,"resumes",{"id":55,"doc_module":22,"doc_module_name":25,"category_name":94,"show_sort_weight":95,"slug":96},"Invoices",70,"invoices",{"id":98,"doc_module":22,"doc_module_name":25,"category_name":99,"show_sort_weight":100,"slug":101},15,"Posters",60,"posters",{"id":103,"doc_module":22,"doc_module_name":25,"category_name":104,"show_sort_weight":105,"slug":106},16,"Social Media",50,"social-media",{"id":108,"doc_module":22,"doc_module_name":25,"category_name":109,"show_sort_weight":110,"slug":111},17,"Forms",40,"forms",{"id":113,"doc_module":22,"doc_module_name":25,"category_name":114,"show_sort_weight":115,"slug":116},18,"Letters",30,"letters",{"id":118,"doc_module":22,"doc_module_name":25,"category_name":119,"show_sort_weight":120,"slug":121},21,"Paper Templates",5,"papers-templates",{"id":123,"doc_module":22,"doc_module_name":25,"category_name":124,"show_sort_weight":4,"slug":125},158,"General","general-158",{"code":4,"msg":82,"data":127},{"doc_id":79,"user_id":128,"nickname":42,"user_avatar":129,"doc_module":22,"category_id":85,"category_name":29,"doc_title":10,"doc_description":12,"doc_content":130,"file_id":131,"file_url":132,"file_type":133,"file_size":134,"view_count":55,"is_deleted":4,"is_public":22,"is_downloadable":22,"audit_status":22,"page_count":113,"language":135,"language_code":8,"site_id":7,"html_lang":8,"table_of_contents":136,"faqs":137,"seo_title":138,"seo_description":12,"update_tm":139,"read_time":140},7971461740886,"https://ap-avatar.wpscdn.com/davatar_3d24733baf745e90a7e4bdd5f77d97b2","Cloud Computing:\nData Security and Privacy Lifecycle Management (DSP)\nInternal Audit Practice Aid\nProgram Description\nCloud services are becoming more critical for Transportation Agencies (TA) as they seek options for efficient digitalization and cost savings. Moving to cloud-based services provides many benefits including greater scalability, cost efficiency, improved agility, improved reliability, and improved business continuity.\nCloud platforms currently have three main delivery models:\nSoftware-as-a-Service (SaaS). SaaS based software or applications are not located on TA’s devices or premises.  Instead, they are accessed by a web-browser or APIs. This allows a more efficient way for the service provider to manage upgrades and security benefiting the user agencies since they are no longer required to maintain the software installs and updates.\nInfrastructure-as-a-Service (IaaS). IaaS is when a vendor provides clients pay-as-you-go access to storage, networking, servers, and other computing resources in the cloud. IaaS clients are responsible for managing aspects such as applications. IaaS lets you bypass the cost and complexity of buying and managing physical servers and datacenter infrastructure.\nPlatform-as-a-Service (PaaS). Unlike SaaS that provides “ready-to-use” software, PaaS provides a platform for software creation. This typically includes operating system, programming language execution environment, database, web server etc.\nThere are four deployment options for cloud service:\nPublic Cloud. A third-party cloud service provider owns and operates all the cloud resources (like servers and storage). The services are provided over the internet.\nGovernment Cloud. Government cloud is designed for government entities (federal, state, or local).  Government cloud meets the standards (FedRAMP, HIPAA, CJIS, etc.) and several security and compliance requirements of many government agencies. Data on US government cloud resides only in the US.\nPrivate Cloud. The cloud resources and infrastructure are operated and maintained on a private network and dedicated to an organization. The private cloud can be located on the organization’s on-site datacenter or hosted by a third party.\nHybrid Cloud. A hybrid cloud combines private cloud with a public and/or government cloud. Data and applications can move between the different environments.\nAs TAs implement more of their IT computing functions and data storage into cloud resources, it becomes increasingly important for auditors to provide added value by giving adequate assurance that TAs controls provide security and efficient and effective operations. In order to accomplish this objective, this Practice Aid assists auditors in developing testing to provide assurance that Data Security and Privacy (DSP) process contains adequate controls. The practice aid relies on Cloud Security Alliance (CSA) Cloud Control Matrix (CCM) version 4.0.3.  CSA is an organization “dedicated to defining and raising awareness of best practices to help ensure a secure cloud computing environment.”  CCM is a cybersecurity control framework for cloud computing, and it provides implementation guidelines and auditing guidelines on how to use the CCM.  Newest version of the CCM can be downloaded from the CSA website.\nStatutes and Regulations\nThe CCM is an internationally recognized standard which supports the European Union or EU’s General Data Protection Regulation (GDPR) which is more stringent than the United States stance on privacy. It is expected that the auditor will research and familiarize themselves with national and state specific statutes and regulations while utilizing the practice aid as a guideline.\nCatalogue of Federal Domestic Assistance (CFDA#)\nNo CFDA applies to this program.\nScope and Objectives\nThe scope of this engagement includes a review of the controls.\nAudit Objectives\nSpecifically, the audit objectives are to determine whether internal controls were adequate to ensure:\n\u0013 TOC \\o \"1-1\" \\f","cbCaij6Ki1Tx23GL","https://ap.wps.com/l/cbCaij6Ki1Tx23GL","docx",68314,"English","# Program Description\n## Cloud delivery models\n## Cloud deployment options\n# Statutes and Regulations\n# Scope and Objectives\n## Audit Objectives\n## DSP-01 through DSP-11 objectives","[{\"question\":\"What is the purpose of this Internal Audit Practice Aid for DSP?\",\"answer\":\"It assists auditors in developing testing to provide assurance that Transportation Agencies’ Data Security and Privacy (DSP) processes contain adequate controls.\"},{\"question\":\"Which frameworks does the practice aid rely on?\",\"answer\":\"It relies on the Cloud Security Alliance (CSA) Cloud Control Matrix (CCM) version 4.0.3, including implementation and auditing guidelines.\"},{\"question\":\"What categories of DSP controls are covered by the audit objectives?\",\"answer\":\"The objectives cover policy and procedures, secure disposal, data inventory and classification, data flow documentation, ownership and stewardship, protection by design and default, privacy by design and default, DPIA, secure transfer, and data subject access rights.\"}]","Cloud Computing - Data Security and Privacy Lifecycle Management (DSP) Internal Audit Practice Aid | DOCX",1788282190,6]