ISACA CCAK flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

NIST cloud essential characteristics

NIST SP 800-145 lists on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service as the five essential characteristics of cloud computing.

IaaS responsibility boundary

In IaaS, the provider manages physical infrastructure, virtualization, and hosting; the consumer manages guest operating systems, middleware, applications, data, identities, and configuration.

SaaS responsibility boundary

In SaaS, the provider manages the application, runtime, middleware, operating system, and infrastructure; the consumer remains responsible for data, identities, access, and configuration choices.

Hybrid versus multi-cloud

Hybrid cloud combines public and private cloud with orchestration between them; multi-cloud uses two or more public cloud providers, which may or may not be integrated.

Zero trust principle

Zero trust treats network location as untrusted and authorizes each request using identity, device posture, and policy, with microsegmentation limiting lateral movement after compromise.

RTO and RPO

Recovery time objective is the maximum acceptable downtime after disruption; recovery point objective is the maximum acceptable data loss measured in time before the disruption.

Serverless shared responsibility

In serverless computing, the provider patches and operates the runtime and infrastructure; the consumer remains responsible for function code, permissions, secrets, data, and event-source configuration.

Governance versus management

Governance evaluates, directs, and monitors through decision rights, risk appetite, and oversight; management plans, builds, runs, and monitors operations within the governance direction.

Cloud Center of Excellence

A cross-functional CCoE defines cloud standards, reference architectures, and reusable controls, and coordinates adoption, but accountable service owners still own workload risk and operations.

COBIT EDM objectives

COBIT governance objectives are evaluate, direct, and monitor (EDM); they are distinct from management objectives in the APO, BAI, DSS, and MEA domains.

Three lines model

The first line owns and manages risk, the second line provides oversight frameworks and challenge, and the third line provides independent assurance to governing bodies.

Cloud policy baseline

A cloud policy baseline covers acceptable use, data classification, residency, approved service models, procurement, identity, encryption, logging, vendor oversight, and exit requirements.

Governance exception rule

A governance exception is time-bound, documented, and accepted at the authority level matching the residual risk; when it expires, the baseline control applies again.

Inherent versus residual risk

Inherent risk is the exposure before controls are applied; residual risk is what remains after controls operate, and it is compared with risk appetite for acceptance or treatment.

Risk treatment options

Cloud risk treatment options are avoid the activity, mitigate likelihood or impact, transfer through contract or insurance, or accept with documented ownership by the accountable risk owner.

Single loss expectancy

Single loss expectancy equals asset value multiplied by exposure factor, where exposure factor is the percentage of the asset lost in one incident.

Annualized loss expectancy

Annualized loss expectancy equals single loss expectancy multiplied by annualized rate of occurrence, giving the expected yearly loss from a risk.

Concentration risk

Concentration risk is dependence on one provider, region, identity provider, or network path; fourth-party risk is exposure through a provider's subcontractors or suppliers.

Cloud risk indicators

Cloud key risk indicators include public storage misconfiguration, excessive privileged identities, stale access, unpatched assets, failed control tests, and repeated SLA breaches.

Data residency versus sovereignty

Data residency requires data to remain in a specified geography; data sovereignty means the data is subject to the laws of the country where it is stored.

GDPR transfer mechanisms

GDPR cross-border transfer mechanisms include adequacy decisions, standard contractual clauses, and binding corporate rules, supported by contractual and technical safeguards appropriate to the transfer.

ISO 27017 purpose

ISO/IEC 27017 provides cloud-specific information security controls and implementation guidance that extend ISO/IEC 27001 for cloud service providers and cloud service customers.

ISO 27018 purpose

ISO/IEC 27018 provides controls for protecting personally identifiable information in public clouds, addressing consent, disclosure, retention, and subprocessor transparency.

SOC report types

SOC 1 addresses financial-reporting controls, SOC 2 addresses security, availability, processing integrity, confidentiality, and privacy, and SOC 3 is a public summary.

Compliance inheritance rule

Provider certifications cover only the provider's scope; customers must implement complementary user entity controls and configure their own workloads to achieve compliance.

SOC 2 Type II

A SOC 2 Type II report tests operating effectiveness of controls over a period, unlike Type I, which reports control design at a single point in time.

CSA STAR levels

CSA STAR has Level 1 self-assessment, Level 2 third-party audit, and Level 3 continuous monitoring; it is provider assurance and does not replace customer-scope testing.

Complementary user entity controls

CUECs are controls the customer must implement for a provider's assurance report to be valid in the customer's environment, such as identity, configuration, and monitoring controls.

Cloud audit evidence

Cloud audit evidence includes API configuration exports, logs, contracts, provider attestations, and access records; it must be sufficient, appropriate, relevant, and reliable.

Audit independence

Audit independence requires objectivity and freedom from conflicts; performing consulting or designing the controls being audited can impair independence and assurance credibility.

Right to audit

A right-to-audit clause defines customer access to provider evidence, notice periods, confidentiality, and whether reliance on independent reports can satisfy the requirement.

Audit sampling integrity

Cloud audit sampling can use API-based population extraction; evidence integrity requires timestamps, hashes, chain of custody, and retention matching the audit period.