Isaca Updated CCAK Exam Questions and Answers by amanda

The most important audit scope document when conducting a review of a cloud service provider is the document that defines the processes and systems to be audited. This document should clearly identify the objectives, criteria, and boundaries of the audit, as well as the roles and responsibilities of the audit team and the cloud service provider. The document should also specify the scope of the cloud service provider’s services, such as the service model, deployment model, geographic location, data classification, and compliance requirements. The document should also describe the scope of the audit evidence, such as the types, sources, methods, and sampling techniques of data collection and analysis. The document should also state the expected deliverables, timelines, and reporting formats of the audit. The document should be agreed upon by both parties before the audit commences.

The document that defines the processes and systems to be audited is essential for ensuring that the audit is relevant, reliable, consistent, and complete. It helps to establish a common understanding and expectation between the auditor and the auditee, as well as to avoid any misunderstandings or conflicts during or after the audit. It also helps to focus the audit on the key risks and controls related to the cloud service provider’s operations and performance. It also helps to ensure that the audit complies with the applicable standards, frameworks, and regulations.

References:

Cloud Audits and Compliance: What You Need To Know - Linford & Company LLP

How to audit the cloud | ICAEW

Auditing Cloud Computing: A Security and Privacy Guide

 ISO/IEC 27017:2015 is a standard that provides guidelines for information security controls applicable to the provision and use of cloud services by providing additional implementation guidance for relevant controls specified in ISO/IEC 27002, as well as additional controls with implementation guidance that specifically relate to cloud services1. ISO/IEC 27017:2015 is designed to be used by organizations for cloud services that intend to select controls within the process of implementing an information security management system based on ISO/IEC 270011. ISO/IEC 27001 is a standard that specifies the requirements for establishing, implementing, maintaining and continually improving an information security management system within the context of the organization.

ISO/IEC 27002 is a standard that provides a code of practice for information security controls, but it does not provide specific guidance for cloud services. NIST SP 800-146 is a publication that provides an overview of cloud computing, its characteristics, service models, deployment models, and security considerations, but it does not provide a standard for selecting controls for cloud services. CSA CCM is a framework that provides detailed understanding of security concepts and principles that are aligned to the Cloud Security Alliance guidance in 13 domains, but it is not a standard that is based on ISO/IEC 27001. References:

ISO/IEC 27017:2015

[ISO/IEC 27001:2013]

[ISO/IEC 27002:2013]

[NIST SP 800-146]

[CSA CCM]

The three main phases of the Cloud Controls Matrix (CCM) mapping methodology are preparation, execution, and peer review and publication. The CCM mapping methodology is a process to map the CCM controls to other standards, regulations, or frameworks that are relevant for cloud security. The mapping helps to identify the commonalities and differences between the CCM and the other standards, regulations, or frameworks, and to provide guidance for cloud service providers and customers on how to achieve compliance with multiple requirements using the CCM. The mapping methodology consists of the following phases1:

Preparation: This phase involves defining the scope, objectives, and deliverables of the mapping project, as well as identifying the stakeholders, resources, and tools needed. This phase also includes conducting a preliminary analysis of the CCM and the other standard, regulation, or framework to be mapped, and establishing the mapping criteria and rules.

Execution: This phase involves performing the actual mapping of the CCM controls to the other standard, regulation, or framework using a spreadsheet template. This phase also includes documenting the mapping results, providing explanations and justifications for each mapping decision, and resolving any issues or conflicts that may arise during the mapping process.

Peer Review and Publication: This phase involves validating and verifying the quality and accuracy of the mapping results by conducting a peer review with subject matter experts from both the CCM working group and the other standard, regulation, or framework organization. This phase also includes finalizing and publishing the mapping document as a CSA artifact, and communicating and promoting the mapping to the relevant audiences.

References := Methodology for the Mapping of the Cloud Controls Matrix1