CCAK Certificate of Cloud Auditing Knowledge.

What CCAK actually certifies

The Certificate of Cloud Auditing Knowledge is a joint credential from ISACA and the Cloud Security Alliance, and it answers a specific gap. Traditional IT audit training assumes you can walk the data centre, inspect the change tickets, and test controls the organisation owns end to end. In the cloud, that assumption breaks. The provider runs the physical infrastructure, the hypervisor, and large parts of the platform, and you never see them. CCAK is built around how you audit and assure that arrangement: how control responsibility is split between customer and provider, what evidence you can actually obtain, and how to reason about assurance when you cannot perform the test yourself.

It is a knowledge certificate rather than an experience-gated certification, so there is no multi-year work requirement attached the way there is with CISA. That makes it accessible earlier in a career, but it is positioned as a complement to deeper audit credentials rather than a replacement. The natural reader is someone who already understands audit method and now needs the cloud-specific layer on top.

What the body of knowledge covers

CCAK is anchored to CSA's own tooling rather than to a single provider's documentation, which is what keeps it vendor-neutral. The core reference points practitioners learn to work with include:

• The Cloud Controls Matrix (CCM), CSA's control framework mapped across cloud domains and cross-referenced to standards such as ISO 27001 and the major regulatory regimes. It is the control catalogue you assess a cloud environment against.
• The Consensus Assessments Initiative Questionnaire (CAIQ), the standardised set of questions a customer puts to a provider to understand which CCM controls the provider operates and how.
• The STAR programme (Security, Trust, Assurance and Risk), CSA's assurance registry. STAR has tiers ranging from provider self-assessment through third-party certification, and CCAK teaches you to read what each tier does and does not prove.
• Shared responsibility, control allocation, and provider-specific audit considerations across the main hyperscalers, so you know which controls you test, which the provider attests to, and where the seam between them sits.

Where CCAK sits next to CISA and CCSP

Practitioners regularly confuse CCAK with the two credentials it lives between, so the distinction is worth drawing cleanly. CISA establishes that you can audit information systems at all. CCSP, from (ISC)2, is a broad cloud security design and architecture credential. CCAK is narrower and more specific than either: it is about assuring cloud, not building it and not auditing systems in general.

In practice the strongest pairing is CISA plus CCAK. CISA gives the audit discipline, the evidence standards, and the independence mindset; CCAK supplies the cloud overlay so that a CISA-holder whose scope has gone cloud-first can assess shared-responsibility boundaries and read STAR evidence without relearning audit from scratch. That is the progression CCAK is designed to serve.