ISC2 Certified Cloud Security Professional (CCSP) Practice Question

The NIST Cloud Computing Reference Architecture defines five primary actors. The Cloud Auditor is an independent entity that conducts objective assessments of a cloud service provider's operations, security controls, and performance for the benefit of both the cloud service consumer and other stakeholders. This aligns exactly with management's requirement for an impartial party to verify regulatory compliance and SLA adherence.

• The Cloud Service Provider operates and manages the cloud environment; it cannot audit itself impartially.
• The Cloud Service Broker intermediates service selection and aggregation but does not perform independent compliance assessments.
• The Cloud Service Consumer (customer) uses the service and may request audits but is not the defined independent assessor. Therefore, selecting the Cloud Auditor best satisfies the stated requirement.