DOMAIN 4 - RIGHT TO AUDIT, AUDIT SCOPE, AUDITOR REQUIREMENTS

Question 1

Reporting needs to include a compliance determination, as well as a list of identified issues, risks, and ________

Answer 1

remediation recommendation

Question 2

Audits and assessments aren’t limited to information security, but those related to information security typically focus on evaluating the ______ of security management and controls.

Answer 2

effectiveness

Question 3

All ______ have variable scope and statement of applicability, which defines what is evaluated (e.g.,
all systems with financial data) and to which controls (e.g., an industry standard, custom scope, or both).

Answer 3

audits

Question 4

An _______ is a legal statement from a third party, which can be used as their statement of audit findings

Answer 4

attestation

Question 5

_________ includes the management of all activities related to audits and assessments, such as determining requirements, scope, scheduling, and responsibilities.

Answer 5

Audit management

Question 6

Customers should understand that providers can (and often should) consider _______ audits a security risk when providing multitenant services

Answer 6

on-premises

Question 7

Customers working with these providers will have to rely more on third-party attestations rather
than audits they perform themselves. Depending on the audit standard, actual results may only be releasable under a ________

Answer 7

nondisclosure agreement (NDA

Question 8

Publishing certifications and attestations (to the degree legally allowed) will greatly assist cloud customers in evaluating providers. ________ offers a central repository for providers to publicly release these documents

Answer 8

The Cloud Security Alliance STAR Registry

Question 9

Some standards, such as ______, attest that documented controls work as designed/required. The
standard doesn’t necessarily define the scope of controls, so both are needed to perform a full evaluation.

Answer 9

SSAE 16

Question 10

It’s important to remember that attestations and certifications are ________

Answer 10

point-in-time activities

Question 11

________are the logs, documentation, and other materials needed for audits and compliance; they are the evidence to support compliance activities

Answer 11

Artifacts

Question 12

______ are ultimately responsible for the artifacts to support their own audits, and thus need to know what the provider offers, and create their own artifacts to cover any gaps.

Answer 12

Customers