An organization is in the initial phases of cloud adoption. It is not very knowledgeable about cloud security and cloud shared responsibility models. Which of the following approaches is BEST suited…

Question

Options

• AUse of an established standard/regulation to map controls and use as the audit criteria
• BFor efficiency reasons, use of its on-premises systems' audit criteria to audit the cloud environment
• CAs this is the initial stage, the ISO/IEC 27001 certificate shared by the cloud service provider is
• DDevelopment of the cloud security audit criteria based on its own internal audit test plans to ensure

• A
  84% (32)
• B
  3% (1)
• C
  11% (4)
• D
  3% (1)

Explanation

For an organization with limited cloud security knowledge, starting with an established standard or regulation (such as CSA CCM, NIST SP 800-53, ISO 27001, or CIS Controls) provides a proven, comprehensive, and cloud-relevant control framework. These standards encode industry best practices and cover the shared responsibility model explicitly. Option B is a common mistake - applying on-premises audit criteria to the cloud ignores fundamental differences in architecture and shared responsibility, leading to gaps and irrelevant controls. Option C (relying solely on the CSP's ISO certificate) only covers the CSP's portion of the shared responsibility and leaves the customer's obligations unaddressed. Option D (developing custom criteria from internal plans) requires expertise the organization does not yet have, risking incomplete coverage.

No community discussion yet for this question.