INQ-02 Informing Cloud Customers about Investigation Requests
Tell the affected cloud customers about a government investigation request without undue delay, withholding notice only where the legal basis invoked forbids disclosure or where there are clear indications of unlawful ac
4
artefacts
1
held by a system
0
at each review
moderate
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Notification records showing the date each affected customer was informed · Document repository
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- Documented justification for any case where notification was withheld · Document repository
- Legal analysis of the disclosure prohibition relied on to stay silent · Document repository
- Procedure defining the notification timeframe and the approving role · Policy repository / GRC workspace
First move
Start with the 1 of 4 artefacts that already live in a system (Document repository); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Notification withheld by default whenever an agency requests confidentiality informally
- No record explaining why a notification exception was applied
- Customers told only after the data had already been handed over
- Silence maintained after the disclosure prohibition has lapsed
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetINQ-01 Legal Assessment of Investigative Inquiries · INQ-03 Conditions for Access to or Disclosure of Data in Investigation Requests