Finally, let's discover what could be used for a cloud audit and assurance.
What we'll do is first separate the definitions of an attestation from a
certification in the cloud, and we'll see how both of these have been
adapted and adopted into cloud platforms.
Finally,
we'll look at the published audit results of a cloud
service provider and see how that could be very useful for
selection criteria. In the past,
when you needed to have trust of a provider, this was
very much a self‑directed platform.
I recall working at a sizable organization and needing
colocation resources from Rackspace and Amazon Web Services when
they were web services and not the cloud.
When I needed to get management sign‑off on moving our
platforms over to AWS and Rackspace,
I was invited to come into the facility and provide my limited powers of
scrutiny of their facilities and my opinion of it to see if it met basic
fitness to warrant our trust for operations.
Today,
I would most likely not receive such an invitation from a CSP to walk
onto their facilities to get a sense of confidence,
but instead, I would actually end up trusting others who were perceiving
what that environment was like in the form of an audit.
So now we have the capability of using organizations as representatives to
go into the cloud service provider and to gain assurance of the controls
based upon established auditing practices.
Those organizations like Ernst & Young, Deloitte, KPMG, PWC have
somewhat of a strange symbiotic relationship between the service
organization and the auditing firm.
In many cases,
the audit firm keeps office space at the provider facility. Based upon certain
rules of engagement and best practices, the auditing firm must maintain at
least two paths of bifurcation that shall not meet.
It is a separation between consultative advisory
offerings and the audit function.
The design is to ensure that the customer can maintain trust that
the auditors provide an authentic feedback on the environment
where the customer has their assets.
There are two primary assurance and trust practices,
the first one, an attestation by the American
Institute of Certified Public Accountants,
otherwise known as AICPA, maintains the standards establish,
requirements for performing and reporting on examination review, and
agreed upon procedure engagements that enable practitioners to report
on subject matter ordinarily other than financial statements, the
effectiveness of those capabilities.
A certification put on by the International Organization for Standards,
maintains required processes,
standards, and guidelines that allow organizations to
use in efforts to certify others.
So certifications can be a useful tool to add credibility by
demonstrating that your product or service meets the
expectations of the customer. First, let's more closely examine attestations.