Preparing to perform a cloud assessment

As an auditor, you are performing a critical role in assessing cloud controls. According to several reputable organizations, most cloud security failures and breaches are due to misconfigurations. Diligent and thorough auditing can help you identify those misconfigurations so that they can be addressed and the associated risks can be remediated. Like many other IT audits, performing a cloud assessment begins with a foundation of IT general controls. A gold standard reference for IT general controls is ISACA COBIT controls. In the cloud context, you need to establish other referential and ancillary frameworks that will help with establishing an audit program that is specific to the cloud. The Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM) is one the leading cloud-specific frameworks. More information on additional frameworks will be shared in the Auditing frameworks and governance section later in this chapter.

In preparing to start...