What testing considerations apply to cloud deployments (IaaS, PaaS, SaaS) from a cybersecurity audit perspective?

• A. Shared responsibility model, data security, access controls, configuration management, logging/monitoring, data location, incident response
• B. Only contractual terms
• C. On-premises tools
• D. Vendor marketing claims

Answer: (C)

Understanding how security testing applies to cloud service models and the shared responsibility model is essential. In IaaS, you handle the security of the guest OS, applications, and data, while the provider secures the underlying infrastructure. In PaaS, the provider takes on more of the stack, but you still must protect your data, enforce access controls, and ensure secure configurations for your applications and integrations. In SaaS, the provider manages most security controls, but you remain responsible for safeguarding your data, managing user access, understanding where data resides, and ensuring appropriate incident response and configuration governance.

An audit should verify both the provider’s security controls and your own, across identity and access management, data security (including encryption and key management), logging and monitoring, and change/configuration management. It should also examine data location and data sovereignty, incident response capabilities, vulnerability and patch management, and continuity planning. Broad governance and risk considerations, plus third-party risk where applicable, are part of the picture too.

Relying only on contractual terms, using on-premises testing tools in a cloud context, or trusting vendor marketing claims would not provide the evidence-based assurance needed for cloud security because actual controls, configurations, and evidence across the cloud stack determine security posture.