Download Publication
.png)
CCM Video Series: A&A - Audit & Assurance
Release Date: 11/11/2024
In this presentation we introduce the Audit and Assurance (A&A) domain within the Cloud Control Matrix (CCM). The A&A domain, consisting of six control specifications, plays a pivotal role in guiding both Cloud Service Providers (CSPs) and Cloud Service Customers (CSCs) to build the confidence required for critical decision-making, communication, and reporting. This domain focuses on key processes, including those embedded in the CCM, and ensures they are evaluated through rigorous assessment, verification, and validation activities.
Designed to support the audit management processes of both CSPs and CSCs, the A&A domain facilitates audit planning, risk analysis, security control assessments, and remediation. It further enables effective reporting and evaluation of attestations and supporting evidence, ensuring transparent and reliable oversight.
The Shared Security Responsibility Model (SSRM) clearly outlines the responsibilities of CSPs and CSCs in implementing the A&A controls within cloud environments. Each party is independently accountable for establishing comprehensive audit and assurance policies, conducting regular security assessments, and adhering to relevant standards and regulatory requirements. By aligning their A&A controls with the SSRM, both CSPs and CSCs can independently fulfill their assurance needs over the control processes defined by the CCM.
Designed to support the audit management processes of both CSPs and CSCs, the A&A domain facilitates audit planning, risk analysis, security control assessments, and remediation. It further enables effective reporting and evaluation of attestations and supporting evidence, ensuring transparent and reliable oversight.
The Shared Security Responsibility Model (SSRM) clearly outlines the responsibilities of CSPs and CSCs in implementing the A&A controls within cloud environments. Each party is independently accountable for establishing comprehensive audit and assurance policies, conducting regular security assessments, and adhering to relevant standards and regulatory requirements. By aligning their A&A controls with the SSRM, both CSPs and CSCs can independently fulfill their assurance needs over the control processes defined by the CCM.
Download this Resource
Are you a research volunteer? Request to have your profile displayed on the website here.
Related Certificates & Training

Learn the core concepts, best practices and recommendation for securing an organization on the cloud regardless of the provider or platform. Covering all 14 domains from the CSA Security Guidance v4, recommendations from ENISA, and the Cloud Controls Matrix, you will come away understanding how to leverage information from CSA's vendor-neutral research to keep data secure on the cloud.
Learn more
Learn more