CCAK: Certificate of Cloud Auditing Knowledge

Access controls provide assurance that only authorized users and processes can access SaaS applications and data, helping protect confidentiality and prevent unauthorized changes. Their design and effectiveness should be assessed against the organization’s security requirements. (nist.gov)

Provider A remains responsible for compliance when its service depends on sub-cloud services. It should pass applicable requirements to the relevant subproviders, typically through contractual obligations, so those requirements are met throughout the supply chain. (tsapps.nist.gov)

Mapping the people who possess the information and data that drive compliance goals helps ensure that the program reflects the organization’s obligations, business objectives, and risks. It also identifies the stakeholders needed to establish accountability and make informed compliance decisions. Metrics support monitoring, but they depend on meaningful goals being established.

Control mappings identify overlapping requirements across frameworks, allowing organizations to reuse applicable assessment evidence and results rather than repeat the same compliance work. Differences in scope or requirements may still require additional assessment. (pages.nist.gov)

Enterprise architecture aligns business goals, processes, applications, and technology across the organization. This broad perspective supports a cloud migration roadmap from strategy through delivery, rather than addressing only the design of individual applications or services. (docs.aws.amazon.com)