Cloud Computing and Cloud Security Auditing Training Course

Course Introduction

Cloud Computing and Cloud Security Auditing Training Course provides a comprehensive and practical framework for professionals responsible for evaluating cloud governance, security controls, technology risks, compliance, resilience, and assurance across modern cloud environments. The programme develops the capabilities required to understand cloud architectures, assess shared responsibilities, identify control weaknesses, and determine whether cloud services adequately protect organisational information and operations.

The course examines the complete cloud security audit lifecycle, beginning with cloud risk assessment, service and architecture analysis, audit planning, control evaluation, evidence collection, technical testing, findings development, reporting, remediation, and follow-up. Participants will learn how to adapt established IT audit techniques to dynamic cloud environments while considering the unique responsibilities of cloud service providers, customers, users, and technology partners.

Particular emphasis is placed on identity and access management, cloud configuration, network security, encryption, data protection, logging, monitoring, vulnerability management, application security, backup, resilience, and incident response. Participants will explore practical methods for assessing whether cloud controls are appropriately designed, consistently configured, effectively monitored, and aligned with organisational risk requirements and applicable compliance obligations.

The programme also addresses different cloud service and deployment models, including infrastructure, platform, and software services, as well as public, private, hybrid, and multi-cloud environments. Participants will examine the assurance implications of cloud migration, containers, serverless computing, infrastructure-as-code, DevOps, APIs, automation, remote access, and highly distributed digital architectures.

Through practical audit scenarios, cloud control assessments, risk analysis, evidence reviews, configuration-testing exercises, and assurance case studies, participants will strengthen their ability to identify cloud-specific risks and translate technical observations into meaningful business impacts. The programme also develops professional judgement for evaluating provider assurance reports, contractual commitments, security responsibilities, and residual risks.

By completing this programme, participants will be better equipped to plan and conduct cloud security audits, evaluate cloud governance and technical controls, assess third-party and shared-responsibility risks, review cloud resilience and compliance, and produce actionable assurance reports. The course supports organisations seeking secure cloud adoption, stronger governance, improved risk visibility, resilient digital services, and sustainable cloud assurance capabilities.

Duration

10 days

Who Should Attend

• Internal auditors responsible for auditing cloud computing environments, cloud security controls, technology risks, and digital services.

• IT auditors seeking advanced techniques for evaluating cloud architectures, configurations, governance, security, and assurance evidence.

• Cybersecurity professionals responsible for securing cloud infrastructure, applications, identities, workloads, and information assets.

• Cloud security architects and engineers seeking stronger understanding of audit requirements, control assessment, and assurance methodologies.

• Information security managers responsible for cloud governance, security strategy, risk management, monitoring, and compliance.

• Risk management professionals evaluating cloud-related operational, cybersecurity, third-party, resilience, data, and technology risks.

• Compliance professionals responsible for assessing cloud services against regulatory, contractual, policy, and information-security requirements.

• IT managers and technology leaders overseeing cloud migration, cloud operations, digital transformation, and technology risk governance.

• DevOps, DevSecOps, and platform engineering professionals seeking greater understanding of cloud controls, audit evidence, and security assurance.

• Data protection and privacy professionals assessing data security, cloud processing, information transfers, and privacy risks in cloud environments.

• Business continuity and disaster recovery professionals evaluating cloud resilience, recovery capabilities, availability, and technology dependencies.

• Vendor and third-party risk professionals responsible for assessing cloud service providers, contracts, assurance reports, and supplier controls.

• External auditors and assurance professionals conducting technology, cybersecurity, cloud, compliance, or operational assurance engagements.

• Senior executives, governance professionals, and audit committee members seeking stronger understanding of cloud security risks and assurance findings.

Course Objectives

• Develop advanced knowledge of cloud computing concepts, cloud security principles, shared responsibility models, and risk-based approaches to cloud auditing.

• Apply structured methodologies for identifying, assessing, prioritising, documenting, and monitoring risks across public, private, hybrid, and multi-cloud environments.

• Evaluate cloud governance structures, policies, responsibilities, security strategies, service models, architecture decisions, and management oversight arrangements.

• Assess cloud identity and access controls covering authentication, authorisation, privileged access, role management, service accounts, and access monitoring.

• Evaluate cloud security configurations, network controls, workload protection, encryption, logging, monitoring, vulnerability management, and security operations.

• Plan and conduct effective cloud security audit engagements by defining scope, objectives, criteria, testing procedures, evidence requirements, and risk priorities.

• Assess the security implications of infrastructure-as-a-service, platform-as-a-service, software-as-a-service, serverless, containers, APIs, and cloud-native architectures.

• Evaluate cloud data protection controls covering classification, encryption, key management, data storage, data transfers, retention, backup, deletion, and information lifecycle management.

• Assess cloud service providers and third parties through due diligence, contractual requirements, service-level commitments, assurance reports, security assessments, and ongoing monitoring.

• Apply cloud audit analytics and technology-enabled testing techniques to identify configuration weaknesses, excessive privileges, anomalies, policy violations, and control exceptions.

• Evaluate cloud resilience, business continuity, disaster recovery, incident response, availability, backup, recovery testing, and operational preparedness for major disruptions.

• Develop evidence-based cloud audit reports and forward-looking assurance strategies addressing emerging technologies, automation, AI, multi-cloud complexity, and evolving cloud security risks.

Comprehensive Course Outline

Module 1: Foundations of Cloud Computing and Cloud Security Auditing

• Cloud computing concepts, characteristics, service models, deployment models, and implications for technology assurance.

• Cloud security auditing principles, objectives, scope, responsibilities, methodologies, and professional judgement requirements.

• Relationships between cloud governance, enterprise risk management, cybersecurity, information security, compliance, and business objectives.

• Major cloud risks affecting confidentiality, integrity, availability, resilience, privacy, accountability, portability, and operational continuity.

Module 2: Cloud Governance, Risk Management and Shared Responsibility

• Cloud governance structures, accountability models, policies, standards, decision rights, oversight arrangements, and management responsibilities.

• Shared responsibility models and allocation of security obligations between cloud customers, providers, users, and technology partners.

• Cloud risk management processes for identifying, analysing, treating, monitoring, escalating, and reporting technology and security risks.

• Alignment of cloud strategy, enterprise objectives, risk appetite, regulatory requirements, security policies, and organisational assurance priorities.

Module 3: Cloud Risk Assessment and Audit Planning

• Identification of cloud assets, workloads, dependencies, threats, vulnerabilities, configurations, business processes, and critical service requirements.

• Risk-based cloud audit planning, audit universe development, engagement prioritisation, resource allocation, and assurance coverage.

• Defining cloud audit scope, objectives, criteria, testing procedures, evidence requirements, sampling strategies, and engagement deliverables.

• Cloud migration and transformation risk assessment covering legacy dependencies, control gaps, architecture changes, and residual technology risks.

Module 4: Cloud Architecture, Infrastructure and Configuration Auditing

• Auditing cloud architectures, accounts, subscriptions, tenants, regions, workloads, network structures, and infrastructure dependencies.

• Cloud configuration management, baseline security standards, configuration drift, hardening requirements, and infrastructure governance.

• Evaluation of infrastructure-as-code, automated provisioning, templates, configuration repositories, deployment controls, and change traceability.

• Testing cloud resources for insecure configurations, unnecessary services, exposed interfaces, weak settings, and deviations from approved security baselines.

Module 5: Cloud Identity and Access Management Auditing

• Cloud identity lifecycle controls covering account creation, role assignment, access modification, termination, periodic review, and reconciliation.

• Privileged access management, administrative accounts, role-based access, service identities, workload identities, and elevated permissions.

• Authentication mechanisms including multifactor authentication, federation, single sign-on, conditional access, and adaptive security controls.

• Audit testing for excessive privileges, dormant accounts, shared credentials, unmanaged identities, conflicting roles, and inappropriate administrative access.

Module 6: Cloud Network and Infrastructure Security Assurance

• Cloud network architecture, segmentation, virtual networks, firewalls, security groups, routing controls, gateways, and secure connectivity.

• Evaluation of network exposure, internet-facing resources, remote access, private connectivity, network monitoring, and traffic control mechanisms.

• Cloud workload protection covering virtual machines, containers, endpoints, operating systems, and infrastructure security configurations.

• Vulnerability management, patching, hardening, configuration assessment, threat detection, and remediation verification across cloud infrastructure.

Module 7: Cloud Data Security, Encryption and Privacy Controls

• Cloud data classification, ownership, storage, processing, movement, retention, deletion, and lifecycle management requirements.

• Encryption at rest and in transit, key management, certificate management, secrets management, and cryptographic control assessment.

• Audit evaluation of database security, object storage, data repositories, backup environments, and cloud-based information processing.

• Privacy and confidentiality risks associated with cloud data locations, access arrangements, information transfers, processing activities, and shared environments.

Module 8: Cloud Application Security, APIs and DevSecOps Auditing

• Cloud application security controls covering authentication, authorisation, secure coding, input validation, session management, and application configuration.

• API security, interface authentication, rate controls, encryption, monitoring, access restrictions, and risks from interconnected digital services.

• DevSecOps governance, security integration, automated testing, code repositories, pipeline controls, deployment approvals, and security gates.

• Container and serverless security auditing covering images, dependencies, runtime controls, secrets, permissions, isolation, and workload monitoring.

Module 9: Cloud Security Monitoring, Logging and Incident Response

• Cloud logging architectures, security event collection, audit trails, monitoring coverage, alerting, retention, and centralised security visibility.

• Evaluation of security monitoring, threat detection, anomaly identification, incident escalation, investigation, and response capabilities.

• Cloud incident response procedures covering containment, eradication, recovery, communication, evidence preservation, and provider coordination.

• Testing readiness for ransomware, account compromise, data exposure, malicious activity, service disruption, configuration errors, and cloud-specific incidents.

Module 10: Cloud Compliance, Regulatory and Assurance Requirements

• Cloud compliance governance, regulatory obligations, contractual requirements, internal policies, industry standards, and security assurance criteria.

• Audit evaluation of compliance controls across cloud services, workloads, information processing, access, data protection, and operational security.

• Provider assurance reports, independent assessments, certifications, control attestations, audit reports, and limitations of third-party assurance evidence.

• Building traceable compliance evidence and evaluating whether cloud control implementation supports applicable organisational and regulatory requirements.

Module 11: Third-Party Cloud Providers and Supply Chain Risk

• Cloud provider due diligence, security assessment, financial and operational considerations, contractual controls, and provider selection processes.

• Evaluation of service-level agreements, security commitments, incident notification, audit rights, data handling, subcontractors, and termination provisions.

• Cloud supply-chain risks involving software dependencies, managed services, technology partners, marketplaces, and external service integrations.

• Ongoing provider monitoring, assurance review, control exceptions, performance evaluation, security incidents, and remediation of third-party weaknesses.

Module 12: Cloud Resilience, Backup and Disaster Recovery Auditing

• Cloud resilience principles for maintaining critical systems and services during cyber incidents, outages, failures, and technology disruptions.

• Backup controls covering frequency, integrity, encryption, isolation, retention, restoration procedures, and protection against malicious deletion.

• Disaster recovery assessment covering recovery objectives, failover mechanisms, alternate environments, dependencies, capacity, and restoration testing.

• Evaluation of high-availability architectures, redundancy, regional resilience, recovery exercises, lessons learned, and continuous improvement.

Module 13: Cloud Audit Evidence, Analytics and Continuous Assurance

• Principles of reliable, sufficient, appropriate, traceable, and reproducible evidence within dynamic and highly automated cloud environments.

• Collection and evaluation of cloud configuration records, access logs, security events, provider reports, system outputs, and automated control evidence.

• Cloud audit analytics for identifying configuration anomalies, excessive permissions, exposed resources, policy violations, and unusual activity.

• Continuous cloud assurance using automated testing, configuration monitoring, dashboards, alerts, control metrics, and near-real-time risk visibility.

Module 14: Artificial Intelligence, Automation and Emerging Cloud Risks

• Cloud security implications of artificial intelligence, machine learning, generative AI workloads, automated decisions, and model-hosting environments.

• Risks associated with AI data exposure, model access, prompt manipulation, insecure integrations, excessive permissions, and uncontrolled cloud-based AI services.

• Emerging cloud architectures involving edge computing, Internet of Things, serverless platforms, containers, APIs, and highly distributed digital environments.

• Assessing technology innovation risks, control adaptation, emerging threat scenarios, responsible cloud adoption, and forward-looking assurance requirements.

Module 15: Cloud Security Audit Reporting, Remediation and Follow-Up

• Development of cloud audit findings covering criteria, condition, cause, effect, risk implications, evidence, management response, and control deficiencies.

• Communicating complex cloud security weaknesses in clear business language to executives, technology leaders, risk committees, and audit committees.

• Developing practical remediation recommendations addressing root causes, configuration weaknesses, governance gaps, ownership, timelines, and residual risks.

• Follow-up assurance procedures for validating corrective actions, reassessing cloud risks, tracking overdue remediation, and escalating unresolved weaknesses.

Module 16: Advanced Cloud Assurance Strategy and Future Cloud Risk

• Integrated assurance across cloud governance, identity, infrastructure, applications, data, cybersecurity, resilience, third parties, and compliance.

• Advanced cloud assurance approaches involving automated control testing, continuous monitoring, threat-informed auditing, analytics, and technology-enabled evidence.

• Future cloud risks involving artificial intelligence, multi-cloud complexity, sovereign cloud requirements, edge computing, quantum technologies, and evolving cyber threats.

• Developing a forward-looking cloud audit strategy that strengthens governance, resilience, security visibility, control effectiveness, and stakeholder confidence.

Training Approach

This course will be delivered by our skilled trainers who have vast knowledge and experience as expert professionals in the fields. The course is taught in English and through a mix of theory, practical activities, group discussion and case studies. Course manuals and additional training materials will be provided to the participants upon completion of the training.

Tailor-Made Course

This course can also be tailor-made to meet organization requirement. For further inquiries, please contact us on: Email: training@upskilldevelopment.com Tel: +254 721 331 808

Training Venue 

The training will be held at our Upskill Training Centre. We also offer training for a group (at a discount of 10% to 50%) at requested location all over the world. The Onsite course fee covers the course tuition, training materials, two break refreshments, buffet lunch, airport transfers, Upskill gift package, and guided tour.

Visa application, travel expenses, dinners, accommodation, insurance, and other personal expenses are catered by the participant

Certification

Participants will be issued with Upskill certificate upon completion of this course.

Airport Pickup and Accommodation

Airport pickup and accommodation is arranged upon request. For booking contact our Training Coordinator through Email: training@upskilldevelopment.com, +254 721 331 808

Terms of Payment:

Unless otherwise agreed between the two parties’ payment of the course fee should be done 3 working days before commencement of the training so as to enable us to prepare better.