You are performing an audit of the security controls used in a cloud environment. Which of the following would best serve your purpose?

A business impact analysis (BIA) assesses the potential effects of an interruption to critical business functions, not the effectiveness of security controls in a cloud environment.

A VM baseline configuration shows how a *single VM* is configured, but doesn't provide an overall assessment of the broader security controls and processes implemented across the entire cloud environment by the provider.

The latest version of the company's financial records is irrelevant for an audit of security controls in a cloud environment.

A SOC 3 report, provided by an external auditor, offers a publicly available summary of a cloud service provider's internal controls relevant to security, availability, processing integrity, confidentiality, and privacy. For an organization auditing security controls in a cloud environment, reviewing this report allows them to gain assurance about the cloud provider's control effectiveness without conducting their own exhaustive audit of the provider's infrastructure.