evels of 
access to more critical systems, and eventually to data.  Systems that depend 
solely on the cloud service provider (CSP) for security are at great risk here.  
Even if encryption is implemented, if the keys are not kept with the customer 
and are only available at data-usage time, the system is still vulnerable to 
malicious insider attack. 
6.2 Controls 
CCM CO-03: Compliance - Third Party Audits 
CCM DG-01: Data Governance - Ownership / Stewardship 
CCM DG-03: Data Governance - Handling / Label