Visibility to the source code within build scripts would give an auditor the best view of design and implementation decisions when an organization uses programmatic automation for Infrastructure as a Service (IaaS) deployments. IaaS is a cloud service model that provides virtualized computing resources, such as servers, storage, network, and operating systems, over the internet. Programmatic automation is the process of using code or scripts to automate the provisioning, configuration, management, and monitoring of the cloud infrastructure. Build scripts are files that contain commands or instructions to create or modify the cloud infrastructure according to the desired specifications.12 An auditor can use the source code within build scripts to gain insight into how the organization designs and implements its cloud infrastructure. The source code can reveal the following information3:
The type, size, and number of cloud resources that are provisioned and deployed The configuration settings and parameters that are applied to the cloud resources The security controls and policies that are enforced on the cloud resources The dependencies and relationships between the cloud resources The testing and validation methods that are used to verify the functionality and performance of the cloud resources The logging and auditing mechanisms that are used to track and record the changes and activities on the cloud resources By reviewing the source code within build scripts, an auditor can evaluate whether the organization follows the best practices and standards for cloud infrastructure design and implementation, such as scalability, reliability, security, compliance, and efficiency. An auditor can also identify any gaps or risks in the organization's cloud infrastructure and provide recommendations for improvement.

Implementing service level agreements (SLAs) around changes to baseline configurations is the most important way to manage risk from cloud vendors who might accidentally introduce unnecessary risk to an organization by adding new features to their solutions. A service level agreement (SLA) is a contract or a part of a contract that defines the expected level of service, performance, and quality that a cloud vendor will provide to an organization. An SLA can also specify the roles and responsibilities, the communication channels, the escalation procedures, and the penalties or remedies for non-compliance12.
Implementing SLAs around changes to baseline configurations can help an organization to manage the risk from cloud vendors who might add new features to their solutions without proper testing, validation, or notification. Baseline configurations are the standard or reference settings for a system or a network that are used to measure and maintain its security and performance. Changes to baseline configurations can introduce new vulnerabilities, errors, or incompatibilities that can affect the functionality, availability, or security of the system or network34. Therefore, an SLA can help an organization to ensure that the cloud vendor follows a change management process that includes steps such as risk assessment, impact analysis, approval, documentation, notification, testing, and rollback. An SLA can also help an organization to monitor and verify the changes made by the cloud vendor and to report and resolve any issues or incidents that may arise from them.
The other options are not the most effective ways to manage the risk from cloud vendors who might add new features to their solutions. Option A, deploying new features using cloud orchestration tools, is not a good way to manage the risk because cloud orchestration tools are used to automate and coordinate the deployment and management of complex cloud services and resources. Cloud orchestration tools do not address the issue of whether the new features added by the cloud vendor are necessary, secure, or compatible with the organization's system or network. Option B, performing prior due diligence of the vendor, is not a good way to manage the risk because prior due diligence is a process that involves evaluating and verifying the background, reputation, capabilities, and compliance of a potential cloud vendor before entering into a contract with them. Prior due diligence does not address the issue of how the cloud vendor will handle changes to their solutions after the contract is signed. Option C, establishing responsibility in the vendor contract, is not a good way to manage the risk because establishing responsibility in the vendor contract is a process that involves defining and assigning the roles and obligations of both parties in relation to the cloud service delivery and performance. Establishing responsibility in the vendor contract does not address the issue of how the cloud vendor will communicate and coordinate with the organization about changes to their solutions. Reference := What is an SLA? Best practices for service-level agreements | CIO1 Service Level Agreements - Cloud Security Alliance2 What is Baseline Configuration? - Definition from Techopedia3 Baseline Configuration - Cloud Security Alliance4 Change Management - Cloud Security Alliance Incident Response - Cloud Security Alliance What is Cloud Orchestration? - Definition from Techopedia Due Diligence - Cloud Security Alliance Contractual Security Requirements - Cloud Security Alliance

The auditor's next course of action should be to review the contract and DR capability of the cloud service provider. This will help the auditor to verify if the provider has a DR plan that meets the organization's requirements and expectations, and if the provider has evidence of testing and validating the plan annually.
The auditor should also check if the contract specifies the roles and responsibilities of both parties, the RTO and RPO values, the SLA terms, and the penalties for non-compliance.
Reviewing the security white paper of the provider (option A) might give some information about the provider's security practices and controls, but it might not be sufficient or relevant to assess the DR plan.
Reviewing the provider's audit reports (option B) might also provide some assurance about the provider's compliance with standards and regulations, but it might not address the specific DR needs of the organization.
Planning an audit of the provider (option D) might be a possible course of action, but it would require more time and resources, and it might not be feasible or necessary if the contract and DR capability are already satisfactory. References:
* Disaster recovery planning guide
* Audit a Disaster Recovery Plan
* How to Maintain and Test a Business Continuity and Disaster Recovery Plan

A dot release of the Cloud Controls Matrix (CCM) indicates a technical change (revision, addition, or deletion) of a number of controls that is smaller than 10% compared to the previous full release. A dot release is a minor update to the CCM that reflects the feedback from the cloud security community and the changes in the cloud technology landscape. A dot release does not change the domain structure or the overall scope of the CCM, but rather improves the clarity, accuracy, and relevance of the existing controls. A dot release is denoted by a decimal number after the major version number, such as CCM v4.1 or CCM v4.2. The current version of the CCM is v4.0, which was released in October 20211.
The other options are incorrect because:
* A. a revision of the CCM domain structure: A revision of the CCM domain structure is a major change that affects the organization and categorization of the controls into different domains. A revision of the CCM domain structure requires a full release, not a dot release, and is denoted by an integer number, such as CCM v3 or CCM v42.
* C. the introduction of new control frameworks mapped to previously published CCM controls: The introduction of new control frameworks mapped to previously published CCM controls is an additional feature that enhances the usability and applicability of the CCM. The introduction of new control frameworks mapped to previously published CCM controls does not require a dot release or a full release, but rather an update to the mapping table that shows the relationship between the CCM controls and other industry-accepted security standards, regulations, and frameworks3.
* D. technical change (revision, addition, or deletion) of a number of controls that is greater than 10% compared to the previous full release: A technical change (revision, addition, or deletion) of a number of controls that is greater than 10% compared to the previous full release is a significant change that affects the content and scope of the CCM. A technical change (revision, addition, or deletion) of a number of controls that is greater than 10% compared to the previous full release requires a full release, not a dot release, and is denoted by an integer number, such as CCM v3 or CCM v42.
References:
* Cloud Controls Matrix (CCM) - CSA
* The CSA Cloud Controls Matrix (CCM) V4: Raising the cloud security bar
* Cloud Security Alliance Releases New Cloud Controls Matrix Auditing Guidelines

In the context of cloud operationalization, "below the waterline" refers to the aspects of cloud services that are managed and controlled by the cloud service provider (CSP) rather than the customer. This analogy is often used to describe the shared responsibility model in cloud computing, where the CSP is responsible for the infrastructure's security and stability, akin to the submerged part of an iceberg that supports the structure above water. The customer, on the other hand, is responsible for managing the controls and security measures
"above the waterline," which include the applications, data, and access management they deploy in the cloud environment.
References = The information provided is based on standard cloud computing models and the shared responsibility concept, which is a fundamental principle discussed in cloud auditing and security literature, including the CCAK curriculum and related resources1.