Certificate of Cloud Auditing Knowledge (CCAK) — Question 213

Who is responsible for determining the risk appetite in the context of cloud?

Answer options

• A. Senior management
• B. Federal regulators
• C. Cloud provider
• D. Internet service provider (ISP)

Correct answer: A

Explanation

Senior management is responsible for setting the organization's risk appetite, including in the context of cloud services. Federal regulators, cloud providers, and ISPs do not define an organization's risk tolerance; instead, they may provide guidance or services within the parameters set by senior management.