ISACA CCAK case studies
ISACA CCAK · Put your knowledge to work in context.
CCAK (Certificate of Cloud Auditing Knowledge) is a cloud-auditing credential associated with ISACA. This page is independent study material; it is not affiliated with, endorsed by, or sponsored by ISACA. The ISACA CCAK case studies are 5 cases and about 4,079 words.
1Single-Cluster SaaS Tenancy for PHI Claims Processing
A regional health insurer is migrating its claims adjudication platform to a SaaS offering. The vendor hosts all tenants in a single PostgreSQL cluster and isolates records with a tenant id column enforced by application middleware; its documentation states that "row-level security is enforced at the application layer." Data is encrypted at rest with AES-256 using keys the vendor generates and stores in its own KMS; the insurer can neither import nor hold its own keys.
828 words, about 4 min2Shadow Cloud Accounts Before a Merger
A 4,000-employee logistics company has 11 business units. Over eight months, engineers have created 47 AWS accounts using corporate credit cards, bypassing the central IT request process; monthly cloud spend rose from 38,000 to 126,000 with no tagging standard.
816 words, about 4 min3Payroll SaaS with a Carve-Out and a Subprocessor Change
A pension fund administrator uses a SaaS HR and payroll platform covering 6,200 employees. The vendor's SOC 2 Type II report includes a carve-out: "the subservice organization, CloudHost Inc., is responsible for physical security and infrastructure." The fund's risk register lists the platform as "medium" risk, last assessed 22 months ago.
783 words, about 4 min4Support-Model Change and a Missing Transfer Addendum
A EU-based online retailer processes data for 14 million customers. It runs its e-commerce stack on a US-headquartered IaaS provider's EU region; the provider's support engineers in the US have "break-glass" access to customer environments for troubleshooting.
830 words, about 4 min5Auditing IAM Changes When the Provider Holds the Hypervisor
You are the lead auditor for an internal audit of a fintech's cloud environment. The firm runs 120 production workloads on a hyperscaler across three accounts.
822 words, about 4 min