Information Systems
Cloud Computing Risks and Controls: CPA Exam Guide
By SimplyCPA · 11 October 2026
Text size
On this page (4)
- NIST definition: On-demand self-service, broad network access, resource pooling, rapid elasticity and measured service.
- Service models: IaaS (infrastructure), PaaS (platform) and SaaS (software) — the customer manages less as you move from IaaS to SaaS.
- Deployment models: Public, private, community and hybrid.
- Shared responsibility: The provider secures the cloud; the customer remains responsible for its data, identities and configuration — misconfiguration is a leading cause of breaches.
- Assurance: Customers rely on SOC 1 and SOC 2 reports from providers, plus their own complementary user entity controls.
The NIST definition (SP 800-145)
Five essential characteristics
- On-demand self-service — provision computing capability without human interaction with the provider.
- Broad network access — available over the network through standard devices.
- Resource pooling — the provider serves multiple customers from shared resources (multi-tenancy).
- Rapid elasticity — capacity scales up and down quickly.
- Measured service — usage is metered and billed.
Three service models
| Model | Provider manages | Customer manages | Examples |
|---|---|---|---|
| Infrastructure as a Service (IaaS) | Physical hardware, networking, virtualisation | Operating systems, applications, data, access | Virtual servers and storage |
| Platform as a Service (PaaS) | Infrastructure plus operating system and runtime | Applications, data, access | Managed databases, app hosting platforms |
| Software as a Service (SaaS) | Everything up to the application | Data, user access, configuration settings | Cloud ERP, payroll, email |
Four deployment models
- Public — open to the general public, owned by a provider.
- Private — for one organisation, on or off premises.
- Community — shared by organisations with common concerns.
- Hybrid — two or more of the above, bound together.
Key risks
- Misconfiguration — publicly exposed storage, overly broad permissions.
- Identity and access — compromised administrator credentials control everything.
- Data location and residency — data stored in jurisdictions with different legal requirements.
- Vendor lock-in and concentration — difficulty exiting or dependence on one provider.
- Availability — provider outages affect many customers at once.
- Visibility — less direct access to logs and infrastructure for audit.
Controls
- Strong identity management: MFA, least privilege, separate administrator accounts.
- Configuration baselines and continuous monitoring for drift.
- Encryption, with customer-managed keys where sensitive.
- Contracts covering service levels, data ownership, breach notification, right to audit and exit.
- Backups to a separate account, region or provider.
- Vendor risk management: review the provider's SOC 2 (and SOC 1 where financial reporting is affected) and test the complementary user entity controls.
Exam trap: Moving to the cloud transfers operational responsibility for some controls, never accountability. A company using SaaS payroll is still responsible for who has access and for the accuracy of the data it inputs.
See also SOC 1 vs SOC 2 reports and ISC third-party and vendor risk.