Cloud Audit and Assurance
What this domain tests
Cloud Audit and Assurance tests how independent evidence is obtained and relied upon. Expect audit types, assurance versus attestation, SOC 2 Type I and Type II, ISO/IEC 27001 certification, the CSA STAR program, scoping, evidence collection, reliance on third-party reports and continuous auditing. Cloud audits often replace direct inspection with provider reports, questionnaires and API-derived evidence.
Core rules
- Assurance is an independent conclusion; attestation is a provider assertion examined by an auditor. Know which one you are relying on.
- SOC 2 Type I addresses design at a point in time; Type II addresses operating effectiveness over a period.
- ISO/IEC 27001 certification covers the ISMS; read the scope statement to see which services, locations and entities are included.
- CSA STAR combines CCM/CAIQ self-assessment with third-party audit options; check which level applies.
- Reliance requires reading scope, period, criteria, complementary user entity controls (CUECs), subservice organizations and exceptions. Then confirm the customer performed its CUECs.
Worked example
An auditor plans to rely on a provider's SOC 2 Type II report. Reasoning: first confirm the report covers the service and period under review. Then review CUECs and test whether the customer performed them, such as configuring SSO or reviewing access. Check whether subservice organizations are carved out or inclusive. Read exceptions and management responses. Supplement with the customer's own configuration and log evidence. A provider audit is not the customer's audit.
Traps
Accepting a report without scope or CUEC review; treating Type I as proof of operating effectiveness; assuming the provider audit covers customer controls; ignoring subservice organizations; relying on annual reports without continuous monitoring.