CCAK – CERTIFICATE OF CLOUD AUDITING KNOWLEDGE

- Describe cloud governance concepts - Explain cloud trust, transparency and assurance - Identify cloud governance frameworks and requirements - Discuss cloud risk management and cloud compliance considerations - Distinguish cloud governance tools and uses

- Explain the fundamental criteria for cloud compliance programs - Build and design a cloud compliance program - Describe legal and regulatory requirements and standards and security frameworks - Define controls and identify technical and process controls - Recall CSA certification, attestation and validation

- Identify the CSA Cloud Controls Matrix (CCM) and CCM domains - Explain the Consensus Assessment Initiative Questionnaire (CAIQ) - Outline CCM and CAIQ structures - Recall CCM relationship with other frameworks (mapping and gap analysis) - Compare transition changes from CCM V3.0.1 to CCM V4

- Describe threat analysis essentials - Use the Top Threat Analysis Methodology to analyze attack details - Document attack impacts based on the Top Threat Analysis Methodology - Apply Threat Analysis Methodology for cloud using CCM - Evaluate a Top Threats method use case

- Describe the compliance program evaluation approach - Recall the governance perspective - Outline the perspectives of laws, regulations and standards - Define service changes - Explain the need for continuous assurance and continuous appliance

- Outline audit characteristics, criteria and principles - Describe auditing standards for cloud computing - Define auditing an on-premises environment vs cloud - Recall differences in cloud services and cloud delivery models - Explain audit building/planning and execution

- Detail CCM Auditing Guidelines - Define the CCM Audit Scoping Guide - Explain the approach taken in the CCM Risk Evaluation Guide - Evaluate the CCM Audit Workbook - Apply the CCM Auditing Guide

- Explain continuous assurance and compliance - Define DevOps and DevSecOps - Apply DevOps and DevSecOps to security - Outline auditing deployment/CI/CD pipelines - Describe DevSecOps automation and maturity

- Outline the components of the STAR program - Explain the security and privacy implications of STAR - Describe the Open Certification Framework - Recall CSA STAR attestation and certification - Detail STAR continuous auditing