CCAK: Certificate of Cloud Auditing Knowledge

By Isaca · Question Mode

QuestionQ75

VerifiedCCM: Auditing Controls

A cloud auditor observed that, just before new software went live, the librarian transferred production data to the test environment to confirm that the new software could work in the production environment.

What additional control should the cloud auditor verify?

Explanation

Copying production data into a test environment can expose customer information to different users or safeguards. Data-owner authorization and management of the associated risks are therefore important controls; documented customer approval is the closest choice. The Cloud Security Alliance control does not, by itself, require separate explicit approval from every customer in all circumstances. (cloudsecurityalliance.org)

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!