Isaca CCAK Dumps Questions Answers

Risk appetite and budget constraints have the most substantial impact on how aggressive or conservative the cloud approach of an organization will be. Risk appetite is the amount and type of risk that an organization is willing to accept in pursuit of its objectives. Budget constraints are the limitations on the financial resources that an organization can allocate to its cloud initiatives. Both factors influence the organization’s strategic decisions on which cloud service models, deployment models, providers, and solutions to adopt, as well as the level of security, compliance, and performance to achieve. An organization with a high risk appetite and a large budget may opt for a more aggressive cloud approach, such as moving critical applications and data to a public cloud provider, while an organization with a low risk appetite and a small budget may opt for a more conservative cloud approach, such as keeping sensitive information on-premises or using a private cloud provider12.

References:

ISACA, Certificate of Cloud Auditing Knowledge (CCAK) Study Guide, 2021, p. 17-18.

CSA, Cloud Controls Matrix (CCM) v4.0, 2021, p. 63.

A SOC2 Type 2 report can best help an auditor to get information about the operating effectiveness of controls addressing privacy, availability, and confidentiality of a service organization. A SOC2 Type 2 report is an internal control report that examines the security, availability, processing integrity, confidentiality, and privacy of a service organization’s system and data over a specified period of time, typically 3-12 months. A SOC2 Type 2 report is based on the AICPA Trust Services Criteria and provides an independent auditor’s opinion on the design and operating effectiveness of the service organization’s controls. A SOC2 Type 2 report can help an auditor to assess the risks and challenges associated with outsourcing services to a cloud provider and to verify that the provider meets the relevant compliance requirements and industry standards.12 References := CCAK Study Guide, Chapter 5: Cloud Auditing, page 971; SOC 2 Type II Compliance: Definition, Requirements, and Why You Need It2

ISO/IEC 27017:2015 is a standard that provides guidelines for information security controls applicable to the provision and use of cloud services by providing additional implementation guidance for relevant controls specified in ISO/IEC 27002, as well as additional controls with implementation guidance that specifically relate to cloud services1. ISO/IEC 27017:2015 is designed to be used by organizations for cloud services that intend to select controls within the process of implementing an information security management system based on ISO/IEC 27001, which is the international standard for information security management systems1. ISO/IEC 27017:2015 can help organizations to establish, implement, maintain and continually improve their information security in the cloud environment, as well as to demonstrate compliance with contractual and legal obligations1.

ISO/IEC 27002 is a code of practice for information security controls that provides best practice recommendations on information security management for use by those who are responsible for initiating, implementing or maintaining information security management systems2. However, ISO/IEC 27002 does not provide specific guidance for cloud services, which is why ISO/IEC 27017:2015 was developed as an extension to ISO/IEC 27002 for cloud services1.

Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM) is a set of security controls that provides organizations with a detailed understanding of security concepts and principles that are aligned to the cloud model. The CCM is not a standard, but rather a framework that can be used to assess the overall security risk of a cloud provider. The CCM can also be mapped to other standards, such as ISO/IEC 27001 and ISO/IEC 27017:2015, to facilitate compliance and assurance activities.

NIST SP 800-146 is a publication from the National Institute of Standards and Technology (NIST) that provides an overview of cloud computing, its characteristics, service models, deployment models, benefits, challenges and considerations. NIST SP 800-146 is not a standard, but rather a reference document that can help organizations to understand the basics of cloud computing and its implications for information security. NIST SP 800-146 does not provide specific guidance or controls for cloud services, but rather refers to other standards and frameworks, such as ISO/IEC 27001 and CSA CCM, for more detailed information on cloud security. References :=

ISO/IEC 27017:2015 - Information technology — Security techniques …

ISO/IEC 27017:2015(en), Information technology ? Security techniques …

ISO 27017 Certification - Cloud Security Services | NQA

An introduction to ISO/IEC 27017:2015 - 6clicks

ISO/IEC 27017:2015 - Information technology — Security techniques …

[Cloud Controls Matrix | Cloud Security Alliance]

[NIST Cloud Computing Synopsis and Recommendations]