ISACA, the international professional association focused on IT governance, has launched a new tool to new support IT auditors in their assessments of AWS deployments - including the use of AWS services, access to the AWS environment, management and interrelationships of AWS services.

By 2020, it is estimated that 41 percent of enterprise workloads will be hosted on public cloud platforms. One of the leading platforms in this space, Amazon Web Services (AWS), has the ability to help teams become more agile; however, without proper knowledge of AWS configurations and potential hazards, enterprises may also open themselves to new risks.

Amazon Web Services® (AWS®) Audit Program  covers AWS applications, functions and containers, and across the domains of governance, network configuration and management, asset configuration and management, logical access control, data encryption controls, logging and event management, security incident response and disaster recovery.

IT audit professionals can follow detailed testing steps outlined for controls across these domains in this audit program spreadsheet to assist in their auditing process, but they are encouraged to customize the document for their unique enterprise needs. The program is free to members, and $US25 for non-members.

“ISACA's AWS Audit Program provides IT audit professionals with the essentials for grasping the breadth and depth of AWS deployments as well as to provide them with a solid foundation for building their own customized audit program around these services,” said Adam Kohnke, CISA, CISSP, Senior IT Auditor for Total Administrative Services Corporation, and lead developer of the AWS Audit Program.

Kohnke elaborates on the topic in his ISACA Journal article, “Auditing Amazon Web Services,” published 1 May, which is available to members. In this feature, Kohnke covers the audit elements related to the eight domains covered in the audit program, while also providing a helpful overview of current AWS service offerings organized by category.

To download the Amazon Web Services (AWS) Audit Program, visit www.isaca.org/Knowledge-Center/Research/ResearchDeliverables/Pages/Amazon-Web-Services-AWS-Audit-Program.aspx. To access the ISACA Journal article, "Auditing Amazon Web Services," visit: www.isaca.org/archives. For more information about ISACA's other audit programs, visit www.isaca.org/Knowledge-Center/Research/Pages/Audit-Assurance-Programs.aspx.