ISACA CCAK study guide
ISACA CCAK · Work through your exam, one topic at a time.
CCAK (Certificate of Cloud Auditing Knowledge) is a cloud-auditing credential associated with ISACA. This page is independent study material; it is not affiliated with, endorsed by, or sponsored by ISACA. The subject matter is the audit and assurance of cloud environments. In practice that means understanding how cloud architecture and design decisions - shared responsibility, service and deployment models, multi-tenancy, virtualization and API-driven control planes - change the evidence an auditor can gather; how governance and risk management adapt when much of the control surface belongs to a provider; how compliance obligations map onto provider attestations plus customer-side controls; and how assurance engagements are scoped, executed and reported when the auditor never touches the underlying infrastructure. The ISACA CCAK study guide has 5 sections and about 1,602 words.
01Cloud Architecture and Design
The Cloud Architecture and Design domain checks whether you can look at a cloud solution and identify where controls actually live. Expect questions on the NIST SP 800-145 service models (IaaS, PaaS, SaaS), deployment models (public, private, community, hybrid), the shared responsibility model, and design choices that affect security and auditability: tenancy, network segmentation, identity and access management, encryption and key management, logging, APIs, portability and interoperability.
355 words, about 2 min02Cloud Governance
Cloud Governance tests whether you can separate direction-setting from execution. Questions cover policy hierarchy, accountability, decision rights, the cloud center of excellence (CCoE), procurement and vendor governance, performance and value measurement, acceptable use, data classification and exit strategy.
303 words, about 2 min03Cloud Risk Management
Cloud Risk Management tests the end-to-end process: identify, analyze, evaluate, treat and monitor. Expect cloud-specific risks such as supply-chain dependency, multi-tenancy, data residency and jurisdiction, vendor lock-in, concentration risk, visibility gaps and ambiguous shared responsibility.
300 words, about 2 min04Cloud Compliance
Cloud Compliance tests how obligations become auditable controls. Topics include scoping, control inheritance, evidence, continuous compliance and framework mapping.
302 words, about 2 min05Cloud Audit and Assurance
Cloud Audit and Assurance tests how independent evidence is obtained and relied upon. Expect audit types, assurance versus attestation, SOC 2 Type I and Type II, ISO/IEC 27001 certification, the CSA STAR program, scoping, evidence collection, reliance on third-party reports and continuous auditing.
342 words, about 2 min