Leadership wants an annual independent report that shows stakeholders how the city's cloud security controls are designed and operating. Which approach fits that goal?
Select an answer to reveal the explanation.
Short Explanation
Stakeholders want a real report card, not a shrug. SOC 2, ISO 27001, or CSA-style assurance gives a structured way to show cloud controls—deleting evidence or posting root keys is the opposite of assurance.
Full Explanation
Leadership seeking an annual independent view of how cloud security controls are designed and operating should use a recognized audit or assurance framework—such as SOC 2, ISO 27001, or CSA guidance—to structure evidence and stakeholder reporting. Those frameworks give municipalities a credible way to demonstrate control design and operating effectiveness rather than relying on anecdote.
Deleting all logs before auditors arrive destroys evidence and trust. Relying solely on informal hallway conversations without evidence fails assurance goals. Publishing production root credentials in the annual report is a critical security failure, not transparency.
Exam caveat: different frameworks emphasize different audiences (customer assurance vs ISMS certification vs cloud control matrices). Know that the goal is demonstrable controls with evidence, not a specific brand name alone.
Operational check: pick the assurance approach fitting stakeholder needs, map city cloud controls to the framework, collect continuous evidence (configs, logs, tickets), remediate gaps, and publish/report results to leadership. Schedule the annual cycle on the civic governance calendar.
Assign control owners for each mapped domain (identity, logging, change, vulnerability) so the annual assurance cycle produces living evidence from day-to-day civic cloud operations rather than a last-minute scramble of screenshots.