CCAK: Certificate of Cloud Auditing Knowledge

By Isaca · Question Mode

QuestionQ24

VerifiedCloud Auditing

During an audit, a critical application hosted in an off-premises cloud was found to be absent from the organization’s disaster recovery plan (DRP). Management stated that it is responsible for ensuring that the cloud service provider has a plan tested annually.

What should the auditor’s NEXT course of action be?

Explanation

Reviewing the contract establishes the provider’s recovery and testing obligations, while assessing its disaster recovery capability helps determine whether the critical application can be restored in line with the organization’s requirements. Evidence of annual testing should also be examined. The organization remains responsible for coordinating the application’s recovery with its own continuity plans. (nvlpubs.nist.gov)

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!