Rule Atlas
SOC 2: Cloud Acquisition: TCO, Shared Responsibility, and Audit Strategy
Under SOC 2 (ISACA / NIST / SOC 2), cloud Acquisition: TCO, Shared Responsibility, and Audit Strategy establishes the authoritative rules tested on the ISACA CISA. Provides a CISA-focused analysis of cloud deployment models (IaaS, PaaS, SaaS). VoraPrep verifies every threshold, worked table, and practice question below against the current ISACA CISA blueprint.
The Shared Responsibility Model
| Control Area | On-Premise | IaaS | PaaS | SaaS |
|---|---|---|---|---|
| Physical Security | Customer | Vendor | Vendor | Vendor |
| Infrastructure (Network, Storage) | Customer | Vendor | Vendor | Vendor |
| Operating System & Middleware | Customer | Customer | Vendor | Vendor |
| Application Logic | Customer | Customer | Customer | Vendor |
| Identity & Access Management | Customer | Shared | Shared | Shared |
| Client & Endpoint Protection | Customer | Customer | Customer | Customer |
| Data Governance & Classification | Customer | Customer | Customer | Customer |
An IS auditor is reviewing the procurement process for a new cloud-based Enterprise Resource Planning (ERP) system at a rapidly growing manufacturing firm. The vendor has proposed a subscription-based licensing model tied to the number of "named users." The auditor notes that the contract lacks a clear definition of how and when license counts will be reconciled (a "true-up" process) and does not specify the vendor's right to audit license usage. What is the MOST significant risk the IS auditor should report regarding this software licensing agreement?
Worked Example: TCO Analysis for a CRM System
Scenario: An IS auditor is reviewing the business case for a new Customer Relationship Management (CRM) system for 'Innovate Corp.' Management is comparing an on-premise solution with a leading SaaS provider over a three-year period.
- 1. On-Premise Solution TCO Server Hardware (CapEx): $40,000 Perpetual Software Licenses (CapEx): $90,000 Annual Maintenance (OpEx): $18,000/year Internal IT Support (OpEx): $20,000/year 3-Year TCO Calculation: $40,000 + $90,000 + (3 $18,000) + (3 * $20,000) = $244,000
- 2. SaaS Solution TCO One-time Implementation Fee (OpEx): $10,000 Monthly Subscription Fee (OpEx): $5,500/month ($66,000/year) 3-Year TCO Calculation: $10,000 + (3 $66,000) = $208,000
- 3. Auditor's Findings and Recommendations Initial Finding: The SaaS solution appears to be $36,000 cheaper over three years based on the provided numbers. Auditor's Inquiry: The auditor reviews the SaaS contract and finds no clause specifying the cost or format for data return upon termination. The vendor's standard terms mention a 'time and materials' fee for data export. Risk Identification: The auditor identifies a significant unquantified risk of vendor lock-in and unpredictable exit costs. Furthermore, the contract specifies that data is stored in a jurisdiction that conflicts with the company's data sovereignty policy. Recommendation: The auditor recommends that management obtain a contractual commitment from the SaaS vendor detailing the data export process, format (e.g., CSV, SQL), and a fixed-cost or not-to-exceed price for the service. The data residency issue must also be resolved before signing the contract. Therefore, the auditor's primary recommendation is to address the contractual gaps related to exit strategy and data sovereignty before proceeding.
- The tempting-but-wrong approach is to focus solely on the 3-year TCO calculation, which shows the SaaS solution is $36,000 cheaper. A junior analyst might approve the project based on this number. However, the IS auditor's value is in identifying the unquantified risks hidden in the contract. The potential cost of data extraction or a regulatory fine for a data sovereignty breach could easily dwarf the apparent savings, making the initial TCO misleading.
Common ISACA CISA Distractors on SOC 2
- 1Use this framework to dissect CISA exam questions on cloud services.
- 2Step 1. Identify the Service Model and its Implications. Is the scenario about IaaS, PaaS, or SaaS? This immediately tells you where responsibility lies. For SaaS, the contract is paramount. For IaaS, the customer's configuration and OS-level controls are key.
- 3Step 2. Pinpoint the Core Risk. Look past the technical details. Is the issue about data ownership, vendor lock-in, regulatory non-compliance (data sovereignty), or a lack of assurance (no SOC 2 report)? CISA questions test governance, not just technology.
- 4Step 3. Scrutinize the Contractual Language. The contract is the primary control in a cloud relationship. The best answer often relates to a missing or weak clause regarding right-to-audit, data return upon termination, or clear data ownership.
Frequently Asked Questions: SOC 2
What is the core rule under SOC 2 (Cloud Acquisition: TCO, Shared Responsibility, and Audit Strategy)?
Under SOC 2 (ISACA / NIST / SOC 2), cloud Acquisition: TCO, Shared Responsibility, and Audit Strategy establishes the authoritative rules tested on the ISACA CISA. Provides a CISA-focused analysis of cloud deployment models (IaaS, PaaS, SaaS). VoraPrep verifies every threshold, worked table, and practice question below against the current ISACA CISA blueprint.
How is SOC 2 tested on the ISACA CISA?
Use this framework to dissect CISA exam questions on cloud services. Step 1. Identify the Service Model and its Implications. Is the scenario about IaaS, PaaS, or SaaS? This immediately tells you where responsibility lies. For SaaS, the contract is paramount. For IaaS, the customer's configuration and OS-level controls are key.
Where can I practice ISACA CISA questions on Cloud Acquisition: TCO, Shared Responsibility, and Audit Strategy?
Test yourself instantly with the free playable ISACA CISA question on this page, or launch VoraPrep's full ISACA CISA adaptive question bank, interactive lessons, and 1:1 exam simulator at voraprep.com/cisa.