An auditor is performing an audit on behalf of a cloud customer. For assessing security awareness, the auditor should:

The correct answer is D. not assess the security awareness training program as it is each organization's responsibility. When an auditor is engaged by a cloud customer to audit cloud operations, the scope is typically limited to the cloud service provider's contractual, technical, and operational controls as they relate to the customer's service agreement. Security awareness training is an…

Cloud Auditing Basics and Tools

Question

Options

Aassess the existence and adequacy of a security awareness training program at the cloud service
Bassess the existence and adequacy of a security awareness training program at both the cloud
Cassess the existence and adequacy of a security awareness training program at the cloud
Dnot assess the security awareness training program as it is each organization's responsibility

How the community answered

(28 responses)

A
4% (1)
C
4% (1)
D
93% (26)

Explanation

When an auditor is engaged by a cloud customer to audit cloud operations, the scope is typically limited to the cloud service provider's contractual, technical, and operational controls as they relate to the customer's service agreement. Security awareness training is an internal organizational program owned by each individual organization - it falls within each organization's own internal HR and administrative responsibility. The auditor for the cloud customer should not unilaterally assess the CSP's internal security awareness training program unless it is explicitly in scope per the audit mandate or required by the relevant certification framework.

Topics

#Shared Responsibility Model#Cloud Audit Scope#Security Awareness Training#Customer Responsibility

Community Discussion

No community discussion yet for this question.

Full CCAK Practice