CCAK – CERTIFICATE OF CLOUD AUDITING KNOWLEDGE

– Describe cloud governance concepts
– Explain cloud trust, transparency and assurance
– Identify cloud governance frameworks and requirements
– Discuss cloud risk management and cloud compliance considerations
– Distinguish cloud governance tools and uses

– Explain the fundamental criteria for cloud compliance programs
– Build and design a cloud compliance program
– Describe legal and regulatory requirements and standards and security frameworks
– Define controls and identify technical and process controls
– Recall CSA certification, attestation and validation

– Identify the CSA Cloud Controls Matrix (CCM) and CCM domains
– Explain the Consensus Assessment Initiative Questionnaire (CAIQ)
– Outline CCM and CAIQ structures
– Recall CCM relationship with other frameworks (mapping and gap analysis)
– Compare transition changes from CCM V3.0.1 to CCM V4

– Describe threat analysis essentials
– Use the Top Threat Analysis Methodology to analyze attack details
– Document attack impacts based on the Top Threat Analysis Methodology
– Apply Threat Analysis Methodology for cloud using CCM
– Evaluate a Top Threats method use case

– Describe the compliance program evaluation approach
– Recall the governance perspective
– Outline the perspectives of laws, regulations and standards
– Define service changes
– Explain the need for continuous assurance and continuous appliance

– Outline audit characteristics, criteria and principles
– Describe auditing standards for cloud computing
– Define auditing an on-premises environment vs cloud
– Recall differences in cloud services and cloud delivery models
– Explain audit building/planning and execution

– Detail CCM Auditing Guidelines
– Define the CCM Audit Scoping Guide
– Explain the approach taken in the CCM Risk Evaluation Guide
– Evaluate the CCM Audit Workbook
– Apply the CCM Auditing Guide

– Explain continuous assurance and compliance
– Define DevOps and DevSecOps
– Apply DevOps and DevSecOps to security
– Outline auditing deployment/CI/CD pipelines
– Describe DevSecOps automation and maturity

– Outline the components of the STAR program
– Explain the security and privacy implications of STAR
– Describe the Open Certification Framework
– Recall CSA STAR attestation and certification
– Detail STAR continuous auditing