Auditing is an independent review process that validates adherence to policies, regulations, and standards. It is essential in assessing security posture. Reference: [Security Guidance v5, Domain 3 - Compliance]

Both providers and consumers should consistently only allow the least privilege required for users.
applications. and other management plane usage.
Reference: CSA Security Guidelines V.4(reproduced here for the educational purpose)

Explanation/Reference:

Quantitative assessments typically employ a set of methods, principles, or rules for assessing risk based on the use of numbers This type of assessment most effectively supports cost-benefit analyses of alternative risk responses or courses of action.