A cloud customer configured and developed a solution on top of the certified cloud services. Building on top of a compliant CSP:

During a review, an IS auditor notes that an organization's marketing department has purchased a cloud-based software application without following the procurement process. What should the auditor do FIRST?

Which of the following attestation allows for immediate adoption of the Cloud Control Matrix (CCM) as additional criteria to AICPA Trust Service Criteria and provides the flexibility to update the criteria as technology and market requirements change?

Which of the following is a corrective control that may be identified in a SaaS service provider?

Which objective is MOST appropriate to measure the effectiveness of password policy?