Duration
2 days
MODULE 1: Cloud Governance
- Overview of governance
- Cloud assurance
- Cloud governance frameworks
- Cloud risk management
- Cloud governance tools
MODULE 2: Cloud Compliance Program
- Designing a cloud compliance program
- Building a cloud compliance program
- Legal and regulatory requirements
- Standards and security frameworks
- Identifying controls and measuring effectiveness
- CSA certification, attestation and validation
MODULE 3: CCM and CAIQ Goals, Objectives and Structure
- CCM
- CAIQ
- Relationship to standards: mappings and gap analysis
- Transition from CCM V3.0.1 to CCM V4
MODULE 4: A Threat Analysis Methodology for Cloud Using CCM
- Definitions and purpose
- Attack details and impacts
- Mitigating controls and metrics
- Use case
MODULE 5: Evaluating a Cloud Compliance Program
- Evaluation approach
- A governance perspective
- Legal, regulatory and standards perspectives
- Risk perspectives
- Services changes implications
- The need for continuous assurance/continuous compliance
MODULE 6: Cloud Auditing
- Audit characteristics, criteria & principles
- Auditing standards for cloud computing
- Auditing an on-premises environment vs. cloud
- Differences in assessing cloud services and cloud delivery models ∙ Cloud audit building, planning and execution
MODULE 7: CCM: Auditing Controls
- CCM audit scoping guidance
- CCM risk evaluation guide
- CCM audit workbook
- CCM an auditing example
MODULE 8: Continuous Assurance and Compliance
- DevOps and DevSecOps
- Auditing CI/CD pipelines
- DevSecOps automation and maturity
MODULE 9: STAR Program
- Standard for security and privacy
- Open Certification Framework
- STAR Registry
- STAR Level 1
- STAR Level 2
- STAR Level 3
WHO SHOULD ATTEND
- Internal and External Assessor and Auditor
- Compliance Manager
- Third-Party Assessor and Auditor
- Vendor/Partners Program Manager
- Security Analyst and Architect
- Procurement Officer
- Cybersecurity Lead/Architect
- Security and Privacy Consultant
Programme scope, delivery arrangements and suitability are confirmed during enquiry.