Which party can conduct independent assessment of cloud service controls and provide an opinion thereon?

• A. Cloud Broker
• B. Cloud Provider
• C. Cloud Auditor
• D. Cloud Carrier

Answer: (C)

The main idea here is that an independent assessment of cloud service controls and an opinion about those controls is provided by a cloud auditor. An auditor is an external, objective party that reviews the controls implemented by a cloud provider, tests how well they work, and issues an attestation or opinion—such as in SOC 2 or ISO 27001 reports. This independence is what gives stakeholders credible assurance about the provider’s security, privacy, and compliance practices.

A cloud provider sets up and operates controls, but they don’t typically issue an independent assessment of their own controls. A cloud broker primarily helps choose and integrate services, not independently assess controls. A cloud carrier is the network service that transports data, not an assessor of security controls. Hence, the party best suited to conduct the assessment and provide an opinion is the cloud auditor.