Engagement Memo—Cloud Computing Practices

We are initiating a review of Amtrak’s (the company) practices for cloud computing— technology that provides on‐demand access to shared servers and databases so that organizations do not have to manage them in‐house. Like other organizations, the company is migrating its technology systems and data to the cloud to reduce operating costs and improve resiliency. Our objective will be to assess the extent to which the company has implemented effective governance processes and security controls for cloud computing. We may expand our scope or modify our objective during the review. We plan to interview company officials; review related policies, documents, and procedures; and analyze relevant company data. We will work to minimize disruptions to the company by coordinating meetings with staff in advance.