Cryptography and authentication are good candidates for continuous auditing, as they are critical

aspects of cloud security that require constant monitoring and verification. Cryptography and

authentication refer to the methods and techniques that ensure the confidentiality, integrity, and

availability of data and communications in the cloud environment. Cryptography involves the use of

encryption algorithms and keys to protect data from unauthorized access or modification.

Authentication involves the use of credentials and tokens to verify the identity and access rights of

users or devices. Continuous auditing can help to assess the effectiveness and compliance of

cryptography and authentication controls, such as data encryption, key management, password

policies, multifactor authentication, single sign-on, etc. Continuous auditing can also help to detect

and alert any anomalies or issues that may compromise or affect cryptography and authentication,

such as data breaches, key leakage, password cracking, unauthorized access, etc123.

Procedures (A) are not good candidates for continuous auditing, as they are not specific or

measurable aspects of cloud security that can be easily automated or tested. Procedures refer to the

steps or actions that are performed to achieve a certain objective or result in a specific domain or

context. Procedures may vary depending on the type, nature, or complexity of the task or process

involved. Continuous auditing requires a clear and consistent definition of the expected outcome or

output, as well as the criteria or metrics to evaluate it. Procedures may not provide such a definition

or criteria, and may require human judgment or interpretation to assess their effectiveness or

compliance123.

Governance (B) is not a good candidate for continuous auditing, as it is not a specific or measurable

aspect of cloud security that can be easily automated or tested. Governance refers to the framework

or system that defines the roles, responsibilities, policies, standards, procedures, and practices for

managing and overseeing an organization or a domain. Governance may involve multiple

stakeholders, such as management, board of directors, regulators, auditors, customers, etc., who

have different interests, expectations, or perspectives. Continuous auditing requires a clear and

consistent definition of the expected outcome or output, as well as the criteria or metrics to evaluate

it. Governance may not provide such a definition or criteria, and may require human judgment or

interpretation to assess its effectiveness or compliance123.

Documentation quality (D) is not a good candidate for continuous auditing, as it is not a specific or

measurable aspect of cloud security that can be easily automated or tested. Documentation quality

refers to the degree to which the documents that describe or support an organization or a domain

are accurate, complete, consistent, relevant, and understandable. Documentation quality may

depend on various factors, such as the purpose, audience, format, style, language, structure,

content, etc., of the documents involved. Continuous auditing requires a clear and consistent

definition of the expected outcome or output, as well as the criteria or metrics to evaluate

it. Documentation quality may not provide such a definition or criteria, and may require human

judgment or interpretation to assess its effectiveness or compliance123. Reference :=

Cloud Audits: A Guide for Cloud Service Providers - Cloud Standards …

Cloud Audits: A Guide for Cloud Service Customers - Cloud Standards …

Cloud Auditing Knowledge: Preparing for the CCAK Certificate Exam