What is the publicly accessible registry documenting the security and privacy controls provided by popular cloud computing offerings?

What is the publicly accessible registry documenting the security and privacy controls provided by popular cloud computing offerings?

• A. Reciprocal Agreements
• B. PIPEDA
• C. COPPA
• D. Cloud Security Alliance's Security Trust Assurance and Risk (CSA STAR)

Answer: (D)

The question is testing understanding of where you can find a public record of the security and privacy controls that cloud services provide. The CSA STAR program from the Cloud Security Alliance is exactly that: a publicly accessible registry where cloud providers publish details of their security and privacy controls, often aligned to the Cloud Controls Matrix and supported by third‑party assessments or attestations. This transparency helps customers compare offerings and understand the level of assurance behind each provider’s controls. The other options aren’t about a public registry of cloud security controls. Reciprocal Agreements relate to mutual arrangements between parties and aren’t a security controls registry. PIPEDA is a Canadian privacy law, not a registry. COPPA is a U.S. law governing the collection of data from children, also not a registry of cloud security controls.

The question is testing understanding of where you can find a public record of the security and privacy controls that cloud services provide. The CSA STAR program from the Cloud Security Alliance is exactly that: a publicly accessible registry where cloud providers publish details of their security and privacy controls, often aligned to the Cloud Controls Matrix and supported by third‑party assessments or attestations. This transparency helps customers compare offerings and understand the level of assurance behind each provider’s controls.

The other options aren’t about a public registry of cloud security controls. Reciprocal Agreements relate to mutual arrangements between parties and aren’t a security controls registry. PIPEDA is a Canadian privacy law, not a registry. COPPA is a U.S. law governing the collection of data from children, also not a registry of cloud security controls.