As organizations continue to shift business operations to hybrid, single cloud or multi-cloud environments, it’s important for auditors to assess risk across different deployment models and platforms. ISACA’s new Google Cloud Platform Audit Program assists auditors in understanding the uniqueness of the Google Cloud Platform (GCP) while effectively assessing an enterprise cloud environment for adherence to organizational risk and compliance objectives.
ISACA introduces new Google Cloud Platform Audit Program
ISACA’s Google Cloud Platform Audit Program includes a spreadsheet file for guidance on testing GCP services and covers the following areas:
- Governance
- Network configuration and management
- Resource configuration and management
- Data security and integrity
- Security incident response
- Business continuity and resiliency
- Security logging and monitoring
- Identity and access management
CIO INFLUENCE News: The anecdotes Compliance OS Launches on Google Cloud Marketplace
The audit program notes that as enterprises tailor and scale services to meet the needs of their operations, one of the most significant areas of risk within a cloud environment is the prevalence of misconfigurations and misunderstandings about shared cloud responsibilities. Particularly, for the GCP, auditors need to understand:
- Concepts around identity and access management
- The Organization/Project/Folder structure
- The impacts of inheritance and hierarchy on access and permissions
- The enablement/disablement of logging options
CIO INFLUENCE News: HyperSense Fraud Management Now Available on Google Cloud
Without a solid understanding of these, there is an increased likelihood that risk goes undetected until an incident occurs.
“With Google Cloud Platform now being the third-largest provider of cloud services, auditors need to make sure they have the necessary tools to assess the adequacy and effectiveness of the platform,” says Robin Lyons, IT Audit Professional Practices Principal at ISACA. “ISACA’s new audit program provides this support to audit professionals, allowing auditors to understand the types of services the GCP provides, the terminology it uses, and the enhancements and innovations offered.”
CIO INFLUENCE News: FEVO Selects SADA and Google Cloud to Support the Company’s Global Business Expansion
[To share your insights with us, please write to sghosh@martechseries.com]
