During an audit of a cloud service provider, the auditor must evaluate the controls in place to ensure data integrity and confidentiality in a…

In a multi-tenant environment, multiple customers share the same physical infrastructure, creating a risk of data leakage or interference. Encryption is the most critical control for this scenario as it provides a strong logical barrier. Encrypting data at rest (on storage) and in transit (over the network) ensures that even if one tenant's data is inadvertently accessed by another, it remains unreadable, thereby preserving both confidentiality and integrity. This control directly mitigates the primary risks associated with resource sharing in the cloud.

A. Implementing strong password policies for all users.

This is a crucial identity and access control, but it does not protect data from being compromised at the infrastructure level between tenants.

C. Regularly conducting security awareness training for staff.

This is an important administrative control to reduce human error but is not the primary technical control for preventing multi-tenant data breaches.

D. Ensuring high availability of cloud services.

This addresses the availability aspect of the CIA triad, not confidentiality or integrity, which are the focus of the question.

1. National Institute of Standards and Technology (NIST). (2011). Special Publication 800-145: The NIST Definition of Cloud Computing. Section: Essential Characteristics, "Resource Pooling".

2. National Institute of Standards and Technology (NIST). (2020). Special Publication 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations. Control: SC-28 Protection of Information at Rest.

3. Subashini, S., & Kavitha, V. (2011). A survey on security issues in service delivery models of cloud computing. Journal of Network and Computer Applications, 34(1), 1-11. https://doi.org/10.1016/j.jnca.2010.07.006. (Discusses encryption as a key solution for multi-tenancy data confidentiality).