CCAK: Certificate of Cloud Auditing Knowledge

Reviewing the cloud provider’s relationship with its service providers helps identify relevant dependencies, control responsibilities, and risks. Because the cloud service relies on those providers, this understanding supports a risk-based decision about the scope and effort of the audit. The level of scrutiny should reflect the services’ criticality and risks, not merely their contractual separation from the customer. (csrc.nist.gov)