IICTI Certified Cloud Security Auditor

Holders demonstrate that they can apply and evaluate cloud assurance frameworks, attestations and reliance, shared responsibility modelling and cloud audit scoping, identity, entitlement and privileged access auditing and cloud posture, policy-as-code and infrastructure-as-code auditing, plus 7 further areas, in realistic professional scenarios, as defined in the AQSCERT scheme for Cloud Security Auditor.

Who it is for: Professionals working, or preparing to work, in security roles.

1. 01Cloud assurance frameworks, attestations and reliance8% of the exam

   • Evaluate cloud provider assurance evidence and determine the extent of reliance it supports.
   • Scope: CSA CCM v4 and CAIQ, CSA STAR, ISO/IEC 27001:2022, 27017 and 27018, SOC 2 Type II, ISAE 3402/3000, BSI C5 and FedRAMP, and evaluating reliance on provider attestation reports.
2. 02Shared responsibility modelling and cloud audit scoping10% of the exam

   • Design risk-based cloud audit scopes that correctly allocate control responsibility between provider and customer.
   • Scope: IaaS, PaaS and SaaS responsibility matrices, complementary user entity controls, carve-out vs inclusive methods, multi-account and multi-tenant scoping and ISACA ITAF audit planning.
3. 03Identity, entitlement and privileged access auditing9% of the exam

   • Evaluate cloud identity and entitlement controls to detect excessive privilege and toxic combinations.
   • Scope: IAM policy evaluation logic, CIEM, effective permissions analysis, cross-account trust and federation, workload identities, root and break-glass accounts, and access recertification evidence.
4. 04Cloud posture, policy-as-code and infrastructure-as-code auditing7% of the exam

   • Evaluate configuration and IaC governance to confirm preventive and detective guardrails operate effectively.
   • Scope: CSPM and CNAPP, CIS Foundations Benchmarks, AWS Config, Azure Policy and Google Organization Policy, OPA, Checkov, configuration drift and IaC pipeline guardrails.
5. 05Data protection, encryption and key management assurance9% of the exam

   • Evaluate data protection and key management controls against confidentiality, residency and sovereignty requirements.
   • Scope: KMS and HSM architectures, BYOK, HYOK and external key managers, rotation and separation of duties, data classification and DLP, residency, GDPR Chapter V transfers and EU Data Act switching.
6. 06Network, workload and container security audit11% of the exam

   • Evaluate network and workload controls for effective isolation and secure runtime configuration.
   • Scope: VPC/VNet segmentation, private endpoints, WAF and DDoS protection, CIS Kubernetes Benchmark, Pod Security Standards, admission control, image signing and provenance, serverless security.
7. 07Logging, detection and incident response effectiveness9% of the exam

   • Evaluate whether cloud logging and detection capabilities would reliably detect and support response to attacks.
   • Scope: Audit log completeness and integrity, retention, SIEM coverage mapping to the MITRE ATT&CK Cloud matrix, detection validation, cloud forensics readiness and incident response testing.
8. 08Continuous control monitoring and automated audit evidence8% of the exam

   • Design continuous auditing approaches that produce reliable, reproducible cloud control evidence.
   • Scope: Compliance-as-code, NIST OSCAL, API-driven evidence collection, evidence integrity and chain of custody, full-population testing vs sampling and audit data analytics.
9. 09Cloud resilience, exit strategy and third-party concentration risk8% of the exam

   • Evaluate cloud dependency, resilience and exit arrangements against regulatory and business continuity requirements.
   • Scope: DORA ICT third-party risk and register of information, EBA outsourcing guidelines, NIS2 supply chain duties, concentration risk, exit plans and multi-region resilience testing.
10. 10Auditing SaaS and AI services in the cloud6% of the exam

    • Evaluate governance and security controls over SaaS and cloud AI services consumed by the organisation.
    • Scope: SSPM and SaaS configuration risk, shadow IT discovery, OAuth app consent, GenAI and LLM service controls, ISO/IEC 42001 and EU AI Act obligations for cloud-hosted AI.
11. 11Cloud audit findings, opinion formation and reporting15% of the exam

    • Lead cloud audit engagements to well-evidenced conclusions and actionable, risk-rated reporting.
    • Scope: IIA Global Internal Audit Standards (2024), evidence sufficiency and appropriateness, root cause analysis, risk rating, management action plans, follow-up and reporting to audit committees.

Question types

Single choice 100%

Delivery

Online (remote proctored), Test centre, On-site (corporate)

Retakes

Up to three attempts within any 12-month period. A 14-day waiting period applies after a first unsuccessful attempt and 30 days after a second. Each retake requires a new booking and fee. Retakes draw a different randomised form from the question bank.

Provisional cut score — psychometric validation is required before live delivery. Blueprint v1.0.

1. 1

   Register

   Create a free account and start the programme.

2. 2

   Practice

   Online practice test (coming soon).

3. 3

   Training

   Optional

   Online course or classroom — or skip it.

4. 4

   Certification

   Independent exam and certification decision.

Training is optional and does not by itself confer certification. Find a training partner