Certificate of Cloud Auditing Knowledge (CCAK) Online Certification Training
Read Reviews

Domain 1: Cloud Governance

• Describe cloud governance concepts.
• Explain cloud trust, transparency, and assurance.
• Identify cloud governance frameworks and requirements.
• Discuss cloud risk management and cloud compliance considerations.
• Distinguish cloud governance tools and uses.

Domain 2: Cloud Compliance Program

• Explain the fundamental criteria for cloud compliance program
• Build and design a cloud compliance program
• Describe legal and regulatory requirements and standards and security frameworks.
• Define controls and identify technical and process controls
• Recall CSA certification, attestation, and validation.

Domain 3: CCM and CAIQ: Goals, Objectives, and Structure

• Identify the CSA Cloud Controls Matrix (CCM) and CCM domains.
• Explain the Consensus Assessment Initiative Questionnaire (CAIQ).
• Outline CCM and CAIQ structures.
• Recall CCM relationships with other frameworks (mapping and gap analysis).
• Compare transition changes from CCM V3.0.1 to CCM V4.

Domain 4: A Threat Analysis Methodology for Cloud Using CCM

• Describe threat analysis essentials.
• Use the Top Threat Analysis Methodology to analyze attack details.
• Document attack impacts based on the Top Threat Analysis Methodology.
• Apply Threat Analysis Methodology for cloud using CCM.
• Evaluate a Top Threats method use case

Domain 5: Evaluating a Cloud Compliance Program

• Describe the compliance program evaluation approach.
• Recall the governance perspective.
• Outline the perspectives of laws, regulations, and standards.
• Define service changes.
• Explain the need for continuous assurance and continuous appliances.

Domain 6: Evaluating a Cloud Compliance Program

• Outline audit characteristics, criteria, and principles.
• Describe auditing standards for cloud computing.
• Define auditing an on-premises environment vs. cloud.
• Recall differences in cloud services and cloud delivery models.
• Explain audit building/planning and execution.

Domain 7: CCM Auditing Guidelines

• Detail CCM Auditing Guidelines.
• Define the CCM Audit Scoping Guide.
• Explain the approach taken in the CCM Risk Evaluation Guide.
• Evaluate the CCM Audit Workbook.
• Apply the CCM Auditing Guide.

Domain 8: Continuous Assurance and Compliance

• Explain continuous assurance and compliance.
• Define DevOps and DevSecOps.
• Apply DevOps and DevSecOps to security.
• Outline auditing deployment/CI/CD pipelines.
• Describe DevSecOps automation and maturity

Domain 9: STAR Program

• Outline the components of the STAR program.
• Explain the security and privacy implications of STAR.
• Describe the Open Certification Framework.
• Recall CSA STAR attestation and certification.
• Detail STAR continuous auditing.