Assessor Resource

ICANWK616A
Manage security, privacy and compliance of cloud service deployment

Assessment tool

Version 1.0
Issue Date: April 2024


This unit applies to those with managerial responsibility, such as experienced security technical specialists, security analysts and security consultants.

This unit describes the performance outcomes, skills and knowledge required to manage cloud security controls, and privacy and legal compliance when implementing cloud services for an enterprise.

You may want to include more information here about the target group and the purpose of the assessments (eg formative, summative, recognition)

Prerequisites

Not applicable.

Employability Skills

This unit contains employability skills.



Evidence Required

List the assessment methods to be used and the context and resources required for assessment. Copy and paste the relevant sections from the evidence guide below and then re-write these in plain English.

The evidence guide provides advice on assessment and must be read in conjunction with the performance criteria, required skills and knowledge, range statement and the Assessment Guidelines for the Training Package.

Overview of assessment

Critical aspects for assessment and evidence required to demonstrate competency in this unit

Evidence of the ability to:

identify, manage and implement cloud security controls according to legal and privacy requirements

integrate cloud security plans into the enterprise’s existing security plans

develop an ongoing performance measurement and evaluation review process.

Context of and specific resources for assessment

Assessment must ensure access to:

cloud information and communications technology (ICT) business specifications

cloud ICT security assurance specifications

management-related scenarios

a cloud focused security environment, including the threats to security that are, or are held to be, present in the environment

information on the security environment, including:

laws or legislation

existing enterprise security policies

enterprise expertise

risk analysis tools and methodologies currently used in industry

appropriate learning and assessment support when required

modified equipment for people with special needs.

Method of assessment

A range of assessment methods should be used to assess practical skills and knowledge. The following examples are appropriate for this unit:

direct observation of candidate managing cloud-related networks and telecommunications security

direct observation of candidate managing cloud ICT security incidents

verbal or written questioning to assess candidate’s knowledge of enterprise policies and procedures that impact on cloud ICT security

review of documentation prepared by candidate, including programs to manage compliance, privacy and risk.

Guidance information for assessment

Holistic assessment with other units relevant to the industry sector, workplace and job role is recommended, where appropriate.

Assessment processes and techniques must be culturally appropriate, and suitable to the communication skill level, language, literacy and numeracy capacity of the candidate and the work being performed.

Indigenous people and other people from a non-English speaking background may need additional support.

In cases where practical assessment is used it should be combined with targeted questioning to assess required knowledge.

Submission Requirements

List each assessment task's title, type (eg project, observation/demonstration, essay, assingnment, checklist) and due date here

Assessment task 1: [title]      Due date:

(add new lines for each of the assessment tasks)

Assessment Tasks

Copy and paste from the following data to produce each assessment task. Write these in plain English and spell out how, when and where the task is to be carried out, under what conditions, and what resources are needed. Include guidelines about how well the candidate has to perform a task for it to be judged satisfactory.

Required skills

analytical skills to analyse security breaches

communication skills to:

communicate with peers and supervisors in relevant cloud computing technological areas

seek assistance and expert advice from relevant people in cloud computing industry area

literacy skills to interpret technical documentation, equipment manuals and specifications

research skills to locate appropriate sources of information regarding cloud computing solutions

technical skills to:

identify features of cloud computing solutions

test and evaluate cloud computing solutions

Required knowledge

business and commercial issues relating to the management of cloud security issues

legislation, organisational and jurisdictional policy and procedures that may impact on management areas:

cloud-related privacy issues

codes of ethics and conduct

equal employment opportunity, equity and diversity principles

financial management requirements

governance requirements

work health and safety (WHS) and environmental requirements

quality standards

management specifications and objectives

management tools and techniques suited to a range of complex projects activities

organisational and political context

systems development life cycle (SDLC)

techniques for critical analysis in a management context

The range statement relates to the unit of competency as a whole. It allows for different work environments and situations that may affect performance. Bold italicised wording, if used in the performance criteria, is detailed below. Essential operating conditions that may be present with training and assessment (depending on the work situation, needs of the candidate, accessibility of the item, and local industry and regional contexts) may also be included.

Security issues may include:

applications security

data security

enterprise continuity

infrastructure security

platform security

virtualisation security.

Delivery models may include:

infrastructure as a service (IaaS)

platform as a service (PaaS)

software as a service (SaaS).

Deployment models may include:

community cloud

hybrid cloud

private cloud

public cloud.

Security responsibility may include:

clients:

applications (if not part of licence)

client employee access

data (if not part of licence)

physical client site security

enterprise (depending on licensing agreement):

data

identity management systems

infrastructure

physical enterprise site security

platform.

Security controls and measures may include:

security management, including:

corrective controls

detective controls

deterrent controls

preventative controls.

Compliance regulations may include:

international regulations

internet or web regulations

local regulations

regional regulations.

Business continuity may include:

undertaking analysis of:

business impact analysis

threat and risk analysis

impact scenarios

solution design

developing solution implementation strategies

testing and enterprise acceptance

implementing suitable maintenance options.

Data recovery may include:

logical damage recovery:

corrupt partitions

overwritten data

physical damage recovery

virus infections.

Legal, privacy and contractual issues may include:

critical data masked

digital identities protected

end-of-service: return of data and applications

intellectual property: ownership of data

liability of data loss

unauthorised on-selling of information.

Continuity of operations program may include:

COOP plan execution

COOP plan revision and updating

COOP program implementation

identification of functional requirements:

mission impact analysis

mitigation strategies and plan

plan design and development

project initiation

risk assessment

training, testing and drills.

Documentation may include:

applicable network-based documents

audits and management reviews

communications protocols

contingency plans and activities

evaluation reports

incident management program, processes and procedures

management reports

network security and telecommunications program

performance measurement program

reviews and improvements records

security classification and data management policies

security incident records.

Copy and paste from the following performance criteria to create an observation checklist for each task. When you have finished writing your assessment tool every one of these must have been addressed, preferably several times in a variety of contexts. To ensure this occurs download the assessment matrix for the unit; enter each assessment task as a column header and place check marks against each performance criteria that task addresses.

Observation Checklist

Tasks to be observed according to workplace/college/TAFE policy and procedures, relevant legislation and Codes of Practice Yes No Comments/feedback
. Identify cloud security issues faced by different delivery and deployment models relevant to enterprise 
. Determine specific enterprise areas of security responsibility 
. Implement most relevant security controls and measures to protect identified areas of responsibility 
. Identify relevant compliance regulations relating to data storage 
. Determine most relevant business continuity and data recovery plans 
. Identify, secure and maintain relevant logs and audit trails 
. Investigate and review legal, privacy and contractual issues to ensure they meet enterprise policy 
. Implement appropriate changes and integrate into current enterprise’s continuity of operation program (COOP) 
. Establish a performance measurement program to evaluate security effectiveness of implemented security controls 
. Provide relevant documentation as part of COOP for audit tracking purposes 

Forms

Assessment Cover Sheet

ICANWK616A - Manage security, privacy and compliance of cloud service deployment
Assessment task 1: [title]

Student name:

Student ID:

I declare that the assessment tasks submitted for this unit are my own work.

Student signature:

Result: Competent Not yet competent

Feedback to student

 

 

 

 

 

 

 

 

Assessor name:

Signature:

Date:

Assessment Record Sheet

ICANWK616A - Manage security, privacy and compliance of cloud service deployment

Student name:

Student ID:

Assessment task 1: [title] Result: Competent Not yet competent

(add lines for each task)

Feedback to student:

 

 

 

 

 

 

 

 

Overall assessment result: Competent Not yet competent

Assessor name:

Signature:

Date:

Student signature:

Date: