We're gonna get a little bit more into this, uh, but again, from the standpoint of artificial intelligence, machine learning. and so on. If you're really interested in this or you want to learn a whole lot more, highly suggest you take the PECB course for 42,001, which will provide a lot more information rather than just a few slides. So machine learning and artificial intelligence are sometimes mistakenly used interchangeably, although they do not represent the same thing. So AI encompasses a broader concept of machines that have the capacity to mimic a human being, whereas the main purpose of machine learning is to enable computers to learn automatically. Okay, so just to be clear, even though AI has a capability to mimic a human being, the AI has to understand what it means to be a human being in order to mimic it. So there it's not a light switch where you turn it on and it automatically works. In machine learning, the processor is given the entry data, and the machine solves the problem by applying various methodologies. Some of the essential algorithms that are used utilized by machine learning are linear regression. logistical regression and decision tree. So the two types of machine learning that's important to understand are supervised and unsupervised Supervised machine learning is used in context of classification and regression. So algorithms used in supervised machine learning including logistic regression, support vector machines, and so on. The aim of both classification and regression is to find the structure of the input data so that it can produce accurate output data. Unsupervised machine learning includes clustering, representation learning, and density estimation. Groups data based on output. So algorithms used in unsupervised machine learning include autoencoders, principal component analysis, and clustering. And then the cluster method is, or cluster analysis is the most common method. So again, if you're interested in uh artificial intelligence machine learning, you really want to take the 4200-1 course as well. There's also cloud computing. This is uh uh something that's been in use for several Seems like at least a couple decades by now. Cloud computing is a delivery of computing services like servers, storage, databases, networking, and processing power. So in general, cloud computing delivers a service of some sort over the internet to the auditee or to you as the customer. There's different categories of uh of uh cloud services or cloud computing. So we have infrastructure as a service or IAAS. So that delivers servers with CPU, memory storage, and so on. And it allows customers to directly access the virtualized hardware. So you could think of Microsoft, Azure, where you're building a virtual server. That would be infrastructure as a service. Platform as a service. Is a complete development and deployment environment in the cloud. It allows developers to scale their cloud resources according to the needs such as CPU cores, memory, and storage. And then we also have software as a service, which is the applications are hosted by the provider and delivered through the web. This allows providers to offer a cloud service to run existing online applications Multiple users can access the same application while the user's data and sessions are isolated from others. So a good example of software as a service would be like uh uh Microsoft O365, where you're accessing the platform itself. We are accessing Outlook through through the browser or maybe G Suite or Gmail. That would be software as a service. So there's uh traditional levels or levels of integration in relation to uh cloud computing. You should sort of understand uh the concepts behind these. So you have traditional IT and that's pretty much the no cloud computing at all. What that means is that uh you as the IT team or the auditee. Would be responsible for everything. And as the auditor who is auditing, the auditee, if they had no cloud computing, then you would have a lot of different areas to audit. So then we get into infrastructure as a service. So for example, there we have less management that we personally have to care about. And we've offloaded some of the responsibility like the storage, the network, the server's virtualization, and so on. We've offloaded that to the hosting provider. Then we also have platform as a service where more and more is offloaded to the hosting provider and the only thing we care about is the application and the data. And then there's even more, software as a service. Again, Gmail is a perfect example of software as a service, or O365 from Microsoft Where you pretty much just use it as as you need to. But they manage everything else on the back end to make it work. Practical approaches for auditors in cloud adoption. The revolution of various organizations brought about by cloud computing necessitates careful consideration. of substantial associated risks. So a few methods auditors use effective to effectively handle the possible challenges that could come out of this are risk assessment and adjustment Inventory of cloud activities, roles and responsibilities, clarification, timely involvement, internal training initiative, and a team-focused approach So all of those come together from the practical approaches for auditors and cloud adoptions. If the uh an auditor is going to uh audit a client or an auditee that has cloud Solutions, then or even if they don't have cloud solutions, auditors should ask the client, do you have any cloud solutions in use? It could be anything. For example If uh if they're a G Suite uh company, uh they should ask them, hey, do you have any cloud solutions that you're using? And if they say, yeah, we use G Suite, okay, they should declare that to the auditor so the auditor can understand it. But also as a part of that, the auditor needs to understand the risks of involving that cloud hosting provider of some sort. What are the risks? And if a company is going to migrate to the cloud, then they need to that company needs to understand the risks and possibly do a risk assessment. And if the auditor is showing up right after that, or possibly right before that That might be something that the auditor asks the auditee, have you done a risk assessment in relation to the transition? What's your risk? And if there's a problem, what are you going to do about it? Outsourcing operations. Um, first off, if you're using a cloud service, you are actually outsourcing something Organizations can select or identify potential controls from any standard or source, like legislation, industry best practices. that it deems appropriate and applicable. Organizations can also outsource different kinds of services like payroll, technical support, HR, and so forth It's very common for uh corporations to outsource something, uh if not one thing, but a whole lot of things. The company ADP, which does payroll transactions in the United States, maybe globally, but they do payroll transactions, a lot of corporations outsource that function of payroll to ADP. So you can outsource responsibility. So in this case it's outsourcing payroll to ADP. uh meaning that ADP has to pay the people, but you can't outsource accountability. And that's important to understand when it comes to ISMS or cybersecurity. So organizations outsource in order to reduce their costs, become more efficient, and focus on crucial operations So again, it's very common to outsource. It could be a variety of different things. Payroll is certainly possible. Technical support is possible. Security operations, forensics. uh cybersecurity in general, human resources, all of that could be outsourced and it's totally applicable. In the case of GDPR, for example, It it literally states in there you can outsource the role of the data protection officer to a third party, provided that they have the same amount of authority. uh to perform their duties uh per GDPR requirements. So auditing the outsourced uh operations, the process of auditing outsourced operations Involves the following steps. This is not just these steps, but basically the understanding of them. Reviewing and evaluating the organization processes for monitoring the quality of their outsourced operations. So how good are they going to do? Do you have SLAs in the contract? Verifying if contractual requirements are met So again, contractual requirements, whatever they are. In some cases, uh in most cases, if you're outsourcing something that's cloud-based. . It's not unreasonable to think that the company is going to require what's known as 5. . 9s. So 99. 999 uptime of that outsourced cloud-based solution Determine whether appropriate governance processes are in place with regard to the engagement of outsourced persons or organizations So are they safe to do business with? Uh do they actually do what they say they're going to do? Do they have to report to anybody? Do they have to be certified in 27,000 one as well? And then reviewing and evaluating the organization's plans in case of expected or unexpected termination of the outsourced agreement. Again, this goes into risk and vendor due diligence, but uh in relation to outsourcing, it's always a suggestion for a company if they've outsourced something. Find a backup in case that primary uh outsourced hosting provider uh goes under, goes out of business, uh decides to, you know, maybe they get a breach or something, who knows? But it's always good to have a backup plan And as a part of that, it's important that the auditor uh gather enough audit evidence regarding contractual agreements between the auditee and the outsourced hosting provider to validate that the the out the auditee has done their vendor due diligence to make sure that they've done what they said they were going to do and that the outsourced hosting provider is safe to do business with. So this could be done a variety of different ways, conduct interviews with persons or persons responsible to uh you know check on the vendors or the suppliers. Uh but it could also be done by looking at the evidence that a uh a uh internal person within the auditee firm, like, okay, did you check this company? Yes. They had a SOC two and ISO twenty seven thousand one. Okay, show them to me. So they can see it. If the uh internal person for the auditee has the material or possibly a risk assessment sheet for that uh outsource per uh outsource company, then it can demonstrate to the auditor that uh proper vendor due diligence was being done. So this is the section summary summary. We're almost over with this one. Technology allows auditors to work more efficiently by minimizing time and costs. Thus, they increase the audit quality. Big data includes a large volume of structured and unstructured data Remember structured data would be think Microsoft SQL SQL. Unstructured data, think uh MongoDB. The Merriam-Webster Dictionary defines big data as an accumulation of data that's too large and complex for processing by traditional database management tools. Artificial intelligence encompasses a broader concept of machines that have the capability or capacity to mimic a human being. Machine learning is related to AI, but they are not interchangeable. The goal of machine learning is to let computers learn automatically. Cloud computing includes the delivery of hosted services over the internet, software as a service, infrastructure as a service, platform as a service are all there. Outsourcing is the practice of hiring a third party, which could be a human being, a person, or an organization, to perform activities, tasks, and provide services for the organization. Again, if you're interested in more learning more about artificial intelligence or machine learning, highly suggest you take the ISO 42001 course. With that, I want to thank everybody for your time. I will see you on the next one.