Cloud Audit Academy
Learn skills and best practices to audit for security in the cloud
Cloud Audit Academy (CAA) is an Amazon Web Services (AWS) Security Auditing Learning Path designed for those that are in auditing, risk, and compliance roles and are involved in assessing regulated workloads in the cloud.
The CAA curriculum forms a leveled learning path that starts with a wide scope (cloud and industry agnostic), and narrows as the learner progresses to focus on AWS and industry-specific content. It includes courses in eLearning and instructor-led training formats.
The curriculum dives into cloud-specific audit considerations and AWS best practices for security auditing aligned to global industry security and compliance frameworks.
Please refer to the Recommended Progression tab below to read more about each level of this curriculum.
Attendees also receive Continuing Professional Education (CPE) units from the most recognize IT governance and security professional associations in the industry.
Security and Compliance Domains
The CAA curriculum focus on the following globally recognized security and compliance domains:
1. Governance, Risk, and Compliance
2. Identity and Access Management
3. Data Security and Privacy
4. Network Management
5. Configuration Management
6. Vulnerability Management
7. User Device Management
8. Logging and Monitoring
9. Incident Response
10. Business Continuity and Contingency Planning
Why Cloud Audit Academy?
Today, control framework language is catered towards on-premises environments, and security IT auditing techniques have not been reshaped for the cloud. At AWS, we believe in empowering our customers to apply cloud-specific verification techniques to their audits in the cloud. Cloud Audit Academy provides auditors with the education and tools to audit for security in the cloud using a risk-based approach.
Partners
Get Started
Free Digital Training
On-demand Cloud Audit Academy courses help you learn and refresh your cloud security auditing skills when and where it’s convenient for you.
Instructor-Led Training
We offer live Cloud Audit Academy classes delivered virtually or in person to teams by subject matter experts and experienced industry standard practitioners from AWS Security Assurance Services, LLC (SAS) and qualified AWS Consulting partners. Please contact us here for additional information on both SAS and partner delivery.*
-
Recommended Progression
Follow this recommended sequence of courses to build your IT security auditing skills in the Security Auditing Learning Path.
Cloud Audit Academy – Foundational
This course provides a baseline knowledge on the differences in auditing in the cloud versus on-premises. It is cloud agnostic and not specific to any industry. It's a high-level introductory workshop that focuses on security auditing concepts in the cloud.
CPE units: 3 or 8 ISACA, 3 or 8 (ISC)², 3 or 8 GIAC, based on delivery format.
Delivery Format:
Online course | Free | 3 Hours
Instructor-led for teams | In-person or Virtual Class | 1 Day (8 Hours)
Recommended prerequisites:
We recommend attendees of this course have an understanding of basic security and network concepts.
Cloud Audit Academy – AWS specific
This course provides security and auditing concepts based on industry-recognized security control domains and standards when operating specifically in AWS. It provides illustrative risk examples and use cases with respective control objectives, activities, and AWS best practices to bring real-world relevance to the content. By the end of the course, attendees should understand approaches for assessing AWS controls implemented and configured by AWS customers to address these illustrative risks and use cases.
This course was built in collaboration with PricewaterhouseCoopers (PwC) and is designed to touch on the following global industry security and compliance frameworks: Cloud Security Alliance Cloud Controls Matrix (CSA CCM); the European General Data Protection Regulation (GDPR); the International Organization for Standardization (ISO) 27001:2013; the National Institute of Standards and Technology (NIST) 800-53; and the Service Organization Controls (SOC) 1 and 2.
Delivery Format:
Instructor-led for teams | In-person or Virtual Class | 4 Days (28 Hours)
Recommended prerequisites:
We recommend attendees of this course have hands-on audit experience.- Cloud Audit Academy – Foundational (or equivalent)
- Certificate in Cloud Auditing Knowledge™(CCAK™)
- AWS Certified Cloud Practitioner (or equivalent)
- AWS Security Fundamentals (or equivalent)
- AWS Certificate Associate or higher (or equivalent)
Cloud Audit Academy – PCI DSS on AWS
This course provides essential training to any assurance, risk, and compliance professionals facing cloud migrations to become knowledgeable on how to assess PCI workloads in the AWS environment with confidence. Leveraging examples, demonstrations, and interactive console walkthroughs, the learner will be educated on what evidence they should be looking for, where to get it, and how it applies to their PCI workloads within the AWS Cloud when using AWS based services.This course was built by AWS Security Assurance Services LLC, a Qualified Security Assessor Company (QSAC), in partnership with ISACA, based on the 12 requirements of Payment Card Industry Data Security Standard (PCI DSS) v3.2.1.
Delivery Format:
Instructor-led for teams | In-person or Virtual Class | 1.5 Day (10 Hours)
Recommended prerequisites:
We recommend attendees of this course have hands-on audit experience.- Cloud Audit Academy – AWS specific (or equivalent)
- Certificate in Cloud Auditing Knowledge™(CCAK™)
- AWS Security Fundamentals (or equivalent)
- AWS Certificate Associate or higher (or equivalent)
-
Frequently Asked Questions (FAQs)
Why should I register for this program?
The Cloud Audit Academy program allows attendees to:
- Prepare for auditing security in the cloud by identifying the differences between auditing in the cloud and on-premises.
- Establish common AWS audit knowledge between internal cloud service customers’ (CSC) departments and external IT auditors.
- Understand how to apply AWS security auditing best practices and use AWS services to assess industry-recognized frameworks, standards, and statutory regulations to help reduce time-to-market for regulated AWS workloads.
- Understand potential methods to address cloud-based risk by utilizing AWS services and AWS best practices in order to effectively and confidently audit the security of CSC AWS workloads.
- Learn through a structured curriculum and ask subject matter experts questions during instructor-led training.
- Learn confidentiality, integrity, and availability concepts for auditing in AWS.
- Gain continuing professional education (CPE) units towards your career development.
Who should attend?
The intended audience for Cloud Audit Academy includes:
- Internal IT Auditors who want to understand how to potentially address cloud-based risk using AWS services and AWS best practices to effectively audit the security of their AWS workloads.
- External IT Auditors who want to learn AWS security and auditing concepts based on industry-recognized standards to successfully perform security auditing on cloud service customers’ (CSC) AWS workloads.
- Regulators who want to understand how CSCs can secure regulated workloads in AWS to develop controls and regulations to better govern workloads in the cloud.
- Security Practitioners who want to understand confidentiality, integrity, and availability auditing concepts in AWS to design and implement controls for securing their AWS workloads.
- Privacy Practitioners who want to understand the security and auditing concepts in AWS to attest and adhere to privacy-related statutory requirements in highly regulated AWS workloads.
- Compliance Practitioners who want to understand how to apply AWS best practices and use AWS services to align with industry-recognized frameworks, standards, and statutory regulations and reduce time-to-market for regulated AWS workloads.
- Cloud Services Customers who want to understand the security and auditing concepts in AWS to adhere to compliance, regulatory, and mandated standards for their AWS workloads.
Who are the instructors?
Subject matter experts and industry standard practitioners from AWS Security Assurance Services, LLC and qualified AWS Consulting partners, instruct the Cloud Audit Academy courses. All instructors are AWS-certified with current audit credentials (such as IIA Certified Internal Auditor (CIA) certification; ISACA Certified Information Systems Auditor (CISA) certification; ISO audit certifications; and/or PCI Qualified Security Assessor) with over five years of cloud audit, compliance, or regulatory experience.
-
Other Suggested Training
AWS Security Fundamentals (Second Edition)
Learn fundamental AWS security concepts including AWS access control, governance, encryption methods, and more.
Online Course | Free | 2 Hours
Learn moreSecurity Engineering on AWS
For security architects, engineers, auditors, and analysts. Learn how to stay secure and compliant in the AWS Cloud, including AWS best practices and security features of key AWS services.
Instructor-led | In-person or Virtual Class | 3 Days
Learn moreAWS Certified Cloud Practitioner
This exam gives individuals an overall understanding of the AWS Cloud to validate their knowledge with an industry-recognized credential. This exam covers four domains, including: Cloud concepts; security; technology; and billing and pricing.
Certificate in Cloud Auditing Knowledge™ (CCAK™)
In partnership with the Cloud Security Alliance (CSA), ISACA® has launched the Certificate in Cloud Auditing Knowledge™(CCAK™)—the first-ever credential of its kind that fills a need for vendor-neutral technical training and credentials in cloud auditing.
Online Course | Paid | 12 Hours
Instructor-Led | Virtual Class | Paid | 12 Hours
Study Guide | Paid
Learn more
ISACA CISA Self-paced Learning
CISA Online Review Course
The CISA Online Review Course is an online preparation course that prepares learners to pass the CISA certification exam using proven instructional design techniques and interactive activities. The course covers all five of the CISA domains, and each section corresponding directly to the CISA job practice.
Online Course | Paid | 22 Hours (12-month subscription)
CISA Review Manual, 27th Edition
Learn MoreCISA Review Questions, Answers & Explanations Database - 12 Month Online Subscription
CISA® Review Questions, Answers & Explanations Database—12 Month Subscription is a comprehensive 1,000-question pool of items that contains the questions from the CISA® Review Questions, Answers & Explanations Manual, 12th Edition.
Review Database | Paid | 12-month subscription
Learn more
ISACA CISM Self-paced Learning
CISM Online Review Course
The CISM Online Review Course is an online preparation course that prepares learners to pass the CISM certification exam using proven instructional design techniques and interactive activities. The course covers all four of the CISM domains, and each section corresponds directly to the CISM job practice.
Online Course | Paid | ~17 Hours (12-month subscription)
CISM Review Manual, 15th Edition
Learn MoreCISM Review Questions, Answers & Explanations Database - 12 Month Online Subscription
CISM® Review Questions, Answers & Explanations Database—12 Month Subscription is a comprehensive 1,000-question pool of items that contains the questions from the CISM® Review Questions, Answers & Explanations Manual, 9th Edition.
Review Database | Paid | 12-month subscription
Learn more
Hear about how AWS customers are using AWS services to provide clarity and transparency into their security and compliance processes.
