Exam CCAK topic 1 question 155 discussion

CCAK Study Guide. Page 320. 6.8.2 Continuous Auditing and Continuous Assurance "...Depending on the level of assurance the organization would need to obtain from its CSP and the level it would need to provide to its shareholders, customer and regulators, the assessors should focus on understanding the following: (...) if the organization follows a DevOps approach, are the controls natively designed into the software?.

CCAK P# 321 Depending on the level of assurance the organization would need to obtain from its CSP and the level it would need to provide to its shareholders, customer and regulators, the assessors should focus on understanding the following: • Whether the frequency of the control evaluation is aligned with the level of assurance required • Whether the controls are designed to meet the requested testing and evaluation frequency (e.g., if the organization follows a DevOps approach, are the controls natively designed into the software?) • Whether the source of evidence allows for continuous auditing (Are logs and feeds available with the level of details and frequency required? Are the logging and monitoring capabilities natively provided by the CSP sufficient, or do external tools need to be integrated? Is the reporting from the CSP, e.g., incident reporting, aligned with the organization’s compliance needs?)