CCAK Exam Dumps : Certificate of Cloud Auditing Knowledge

 Access controls are an assurance requirement when an organization is migrating to a SaaS provider because they ensure that only authorized users can access the cloud services and data. Access controls also help to protect the confidentiality, integrity and availability of the cloud resources. Access controls are part of the Cloud Control Matrix (CCM) domain IAM-01: Identity and Access Management Policy and Procedures, which states that "The organization should have a policy and procedures to manage user identities and access to cloud services and data."1 References := CCAK Study Guide, Chapter 4: A Threat Analysis Methodology for Cloud Using CCM, page 751

 An organization employing the Cloud Controls Matrix (CCM) to perform a compliance assessment leverages the Scope Applicability direct mapping to understand which controls encompassed by the CCM may already be partially or fully implemented because of the compliance with other standards. The Scope Applicability direct mapping is a worksheet within the CCM that maps the CCM control specifications to several standards within the ISO/IEC 27000 series, such as ISO/IEC 27001, ISO/IEC 27002, ISO/IEC 27017, and ISO/IEC 27018. The mapping helps the organization to identify the commonalities and differences between the CCM and the ISO/IEC standards, and to determine the level of compliance with each standard based on the implementation of the CCM controls. The mapping also helps the organization to avoid duplication of work and to streamline the compliance assessment process.12 References := What you need to know: Transitioning CSA STAR for Cloud Controls Matrix …1; Cloud Controls Matrix (CCM) - CSA3

 The CSA STAR Attestation allows for the immediate adoption of the Cloud Controls Matrix (CCM) as additional criteria alongside the AICPA Trust Service Criteria. It also offers the flexibility to update the criteria as technology and market requirements evolve. This is because the CSA STAR Attestation is a combination of SOC 2 and additional cloud security criteria from the CSA CCM, providing guidelines for CPAs to conduct SOC 2 engagements using criteria from both the AICPA and the CSA Cloud Controls Matrix.

References = The information is supported by the Cloud Security Alliance’s resources, which explain that the CSA STAR Attestation integrates SOC 2 with additional criteria from the CCM, allowing for a comprehensive approach to cloud security that aligns with evolving technologies and market needs1.