Isaca Updated CCAK Exam Questions and Answers by blake

 The Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM) would be the best information security control framework to implement for a new company that has all its operations in the cloud. The CCM is a cybersecurity control framework for cloud computing that is aligned to the CSA best practices and is considered the de-facto standard for cloud security and privacy. The CCM covers 17 domains and 197 control objectives that address all key aspects of cloud technology, such as data security, identity and access management, encryption and key management, incident response, audit assurance, and compliance. The CCM also maps to other industry-accepted security standards, regulations, and frameworks, such as ISO 27001/27002/27017/27018, NIST SP 800-53, PCI DSS, COBIT, FedRAMP, etc., which can help the company to achieve multiple compliance goals with one framework. The CCM also provides guidance on the shared responsibility model between cloud service providers and cloud customers, and helps to define the organizational relevance of each control12.

References:

Cloud Controls Matrix (CCM) - CSA

Cloud Controls Matrix and CAIQ v4 | CSA - Cloud Security Alliance

The Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM) is the best tool to perform cloud security control audits, as it is a comprehensive framework that provides organizations with a detailed understanding of security concepts and principles that are aligned to the cloud model. The CCM covers 16 domains of cloud security, such as data security, identity and access management, encryption and key management, incident response, and audit assurance and compliance. The CCM also maps to other standards, such as ISO 27001, NIST SP 800-53, PCI DSS, COBIT, and GDPR, to facilitate compliance and assurance activities1.

The General Data Protection Regulation (GDPR) is not a tool, but rather a regulation that aims to protect the personal data and privacy of individuals in the European Union (EU) and the European Economic Area (EEA). The GDPR imposes strict requirements on organizations that process personal data of individuals in these regions, such as obtaining consent, ensuring data security, reporting breaches, and respecting data subject rights. The GDPR is relevant for cloud security audits, but it is not a comprehensive framework that covers all aspects of cloud security2.

The Federal Information Processing Standard (FIPS) 140-2 is not a tool, but rather a standard that specifies the security requirements for cryptographic modules used by federal agencies and other organizations. The FIPS 140-2 defines four levels of security, from Level 1 (lowest) to Level 4 (highest), based on the design and implementation of the cryptographic module. The FIPS 140-2 is important for cloud security audits, especially for organizations that handle sensitive or classified information, but it is not a comprehensive framework that covers all aspects of cloud security3.

ISO 27001 is a standard that specifies the requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS). An ISMS is a systematic approach to managing information security risks and ensuring the confidentiality, integrity and availability of information assets. ISO 27001 is relevant for cloud security audits, as it provides a framework for assessing and improving the security posture of an organization. However, ISO 27001 does not provide specific guidance or controls for cloud services, which is why ISO 27017:2015 was developed as an extension to ISO 27001 for cloud services4. References :=

Cloud Controls Matrix | Cloud Security Alliance

General Data Protection Regulation - Wikipedia

FIPS PUB 140-2 - NIST

ISO/IEC 27001:2013(en), Information technology ? Security techniques …

The CSA STAR Certification is based on criteria outlined in the Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM) in addition to ISO/IEC 27001 implementation. ISO/IEC 27001 is an international standard that specifies the requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS). The CSA STAR Certification is a third-party independent assessment of the security of a cloud service provider, which demonstrates the alignment of the provider’s ISMS with the CCM best practices. The CSA STAR Certification has three levels: Level 1 (STAR Certification), Level 2 (STAR Attestation), and Level 3 (STAR Continuous Monitoring).1 [2][2] References := CCAK Study Guide, Chapter 5: Cloud Auditing, page 971; CSA STAR Certification, Overview[2][2]