CCSP Exam Topics
Domain 1: Cloud Concepts, Architecture and Design 17%
1.1 Understand cloud computing concepts
- Cloud computing definitions
- Cloud computing roles (e.g., cloud service customer, cloud service provider, cloud service partner, cloud service broker)
- Key cloud computing characteristics (e.g., on-demand self-service, broad network access, multi-tenancy, rapid elasticity and scalability, resource pooling, measured service)
- Building block technologies (e.g., virtualization, storage, networking, databases, orchestration)
1.2 Describe cloud reference architecture
- Cloud computing activities
- Cloud service capabilities (i.e., application capability types, platform capability types, infrastructure capability types)
- Cloud service categories (e.g., Software as a Service (SaaS), Infrastructure as a Service (IaaS), Platform as a Service (PaaS))
- Cloud deployment models (e.g., public, private, hybrid, community)
- Cloud shared considerations (e.g., interoperability, portability, reversibility, availability, security, privacy, resiliency, performance, governance, maintenance and versioning, service levels and Service Level Agreements (SLA), auditability, regulatory)
- Impact of related technologies (e.g., machine learning, artificial intelligence, blockchain, Internet of Things (IoT), containers, quantum computing)
1.3 Understand security concepts relevant to cloud computing
- Cryptography and key management
- Access control
- Data and media sanitization (e.g., overwriting, cryptographic erase)
- Network security (e.g., network security groups)
- Virtualization security (e.g., hypervisor security, container security)
- Common threats
1.4 Understand design principles of secure cloud computing
- Cloud secure data lifecycle
- Cloud based Disaster Recovery (DR) and Business Continuity (BC) planning
- Cost benefit analysis
- Functional security requirements (e.g., portability, interoperability, vendor lock-in)
- Security considerations for different cloud categories (e.g., Software as a Service (SaaS), Infrastructure as a Service (IaaS), Platform as a Service (PaaS))
1.5 Evaluate cloud service providers
- Verification against criteria (e.g., International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 27017, Payment Card Industry Data Security Standard (PCI DSS))
- System/subsystem product certifications (e.g., Common Criteria (CC), Federal Information Processing Standard (FIPS) 140-2)
Domain 2: Cloud Data Security 19%
2.1 Describe cloud data concepts
- Cloud data life cycle phases
- Data dispersion
2.2 Design and implement cloud data storage architectures
- Storage types (e.g., long term, ephemeral, raw-disk)
- Threats to storage types
2.3 Design and apply data security technologies and strategies
- Encryption and key management
- Hashing
- Masking
- Tokenization
- Data Loss Prevention (DLP)
- Data obfuscation
- Data de-identification (e.g., anonymization)
2.4 Implement data discovery
- Structured data
- Unstructured data
2.5 Implement data classification
- Mapping
- Labeling
- Sensitive data (e.g., Protected Health Information (PHI), Personally Identifiable Information (PII), card holder data)
2.6 Design and implement Information Rights Management (IRM)
- Objectives (e.g., data rights, provisioning, access models)
- Appropriate tools (e.g., issuing and revocation of certificates)
2.7 Plan and implement data retention, deletion, and archiving policies
- Data retention policies
- Data deletion procedures and mechanisms
- Data archiving procedures and mechanisms
- Legal hold
2.8 Design and implement auditability, traceability, and accountability of data events
- Definition of event sources and requirement of identity attribution
- Logging, storage, and analysis of data events
- Chain of custody and non-repudiation
Domain 3: Cloud Platform and Infrastructure Security 17%
3.1 Comprehend cloud infrastructure components
- Physical environment
- Network and communications
- Compute
- Virtualization
- Storage
- Management plane
3.2 Design a secure data center
- Logical design (e.g., tenant partitioning, access control)
- Physical design (e.g., location, buy or build)
- Environmental design (e.g., Heating, Ventilation and Air Conditioning (HVAC), multi-vendor pathway connectivity)
3.3 Analyze risks associated with cloud infrastructure
- Risk assessment and analysis
- Cloud vulnerabilities, threats and attacks
- Virtualization risks
- Counter-measure strategies
3.4 Design and plan security controls
- Physical and environmental protection (e.g., on-premise)
- System and communication protection
- Virtualization systems protection
- Identification, authentication, and authorization in cloud infrastructure
- Audit mechanisms (e.g., log collection, packet capture)
3.5 Plan Disaster Recovery (DR) and Business Continuity (BC)
- Risks related to the cloud environment
- Business requirements (e.g., Recovery Time Objective (RTO), Recovery Point Objective (RPO), Recovery Service Level (RSL))
- Business Continuity/Disaster Recovery strategy
- Creation, implementation and testing of plan
Domain 4: Cloud Application Security 17%
4.1 Advocate training and awareness for application security
- Cloud development basics
- Common pitfalls
- Common cloud vulnerabilities
4.2 Describe the Secure Software Development Life Cycle (SDLC) process
- Business requirements
- Phases and methodologies
4.3 Apply the Secure Software Development Life Cycle (SDLC)
- Avoid common vulnerabilities during development
- Cloud-specific risks
- Quality Assurance
- Threat modeling
- Software configuration management and versioning
4.4 Apply cloud software assurance and validation
- Functional testing
- Security testing methodologies
4.5 Use verified secure software
- Approved Application Programming Interfaces (API)
- Supply-chain management
- Third party software management
- Validated open source software
4.6 Comprehend the specifics of cloud application architecture
- Supplemental security components (e.g., Web Application Firewall (WAF), Database Activity Monitoring (DAM), Extensible Markup Language (XML) firewalls, Application Programming Interface (API) gateway)
- Cryptography
- Sandboxing
- Application virtualization and orchestration
4.7 Design appropriate Identity and Access Management (IAM) solutions
- Federated identity
- Identity providers
- Single Sign-On (SSO)
Domain 5: Cloud Security Operations 17%
5.1 Implement and build physical and logical infrastructure for cloud environment
- Hardware specific security configuration requirements (e.g., Basic Input Output System (BIOS) settings for virtualization and Trusted Platform Module (TPM), storage controllers, network controllers)
- Installation and configuration of virtualization management tools
- Virtual hardware specific security configuration requirements (e.g., network, storage, memory, Central Processing Unit (CPU))
- Installation of guest Operating System (OS) virtualization toolsets
5.2 Operate physical and logical infrastructure for cloud environment
- Configure access control for local and remote access (e.g., Secure Keyboard Video Mouse (KVM), Console-based access mechanisms, Remote Desktop Protocol (RDP))
- Secure network configuration (e.g., Virtual Local Area Networks (VLAN), Transport Layer Security (TLS), Dynamic Host Configuration Protocol (DHCP), Domain Name System (DNS), Virtual Private Network (VPN))
- Operating System (OS) hardening through the application of baselines (e.g., Windows, Linux, VMware)
- Availability of stand-alone hosts
- Availability of clustered hosts (e.g., Distributed Resource Scheduling (DRS), Dynamic Optimization (DO), storage clusters, maintenance mode, high availability)
- Availability of guest Operating System (OS)
5.3 Manage physical and logical infrastructure for cloud environment
- Access controls for remote access (e.g., Remote Desktop Protocol (RDP), Secure Terminal Access, Secure Shell (SSH))
- Operating System (OS) baseline compliance monitoring and remediation
- Patch management
- Performance and capacity monitoring (e.g., network, compute, storage, response time)
- Hardware monitoring (e.g., disk, Central Processing Unit (CPU), fan speed, temperature)
- Configuration of host and guest Operating System (OS) backup and restore functions
- Network security controls (e.g., firewalls, Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS), honeypots, vulnerability assessments, network security groups)
- Management plane (e.g., scheduling, orchestration, maintenance)
5.4 Implement operational controls and standards (e.g., Information Technology Infrastructure Library (ITIL), International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 20000-1)
- Change management
- Continuity management
- Information security management
- Continual service improvement management
- Incident management
- Problem management
- Release management
- Deployment management
- Configuration management
- Service level management
- Availability management
- Capacity management
5.5 Support digital forensics
- Forensic data collection methodologies
- Evidence management
- Collect, acquire and preserve digital evidence
5.6 Manage communication with relevant parties
- Vendors
- Customers
- Partners
- Regulators
- Other stakeholders
5.7 Manage security operations
- Security Operations Center (SOC)
- Monitoring of security controls (e.g., firewalls, Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS), honeypots, vulnerability assessments, network security groups)
- Log capture and analysis (e.g., Security Information and Event Management (SIEM), log management)
- Incident management
Domain 6: Legal, Risk and Compliance 13%
6.1 Articulate legal requirements and unique risks within the cloud environment
- Conflicting international legislation
- Evaluation of legal risks specific to cloud computing
- Legal frameworks and guidelines
- eDiscovery (e.g., International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 27050, Cloud Security Alliance (CSA) Guidance)
- Forensics requirements
6.2 Understand privacy issues
- Difference between contractual and regulated private data (e.g., Protected Health Information (PHI), Personally Identifiable Information (PII))
- Country-specific legislation related to private data (e.g., Protected Health Information (PHI), Personally Identifiable Information (PII))
- Jurisdictional differences in data privacy
- Standard privacy requirements (e.g., International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 27018, Generally Accepted Privacy Principles (GAPP), General Data Protection Regulation (GDPR))
6.3 Understand audit process, methodologies, and required adaptations for a cloud environment
- Internal and external audit controls
- Impact of audit requirements
- Identify assurance challenges of virtualization and cloud
- Types of audit reports (e.g., Statement on Standards for Attestation Engagements (SSAE), Security Operations Center (SOC), International Standard on Assurance Engagements (ISAE))
- Restrictions of audit scope statements (e.g., Statement on Standards for Attestation Engagements (SSAE), International Standard on Assurance Engagements (ISAE))
- Gap analysis
- Audit planning
- Internal Information Security Management System (ISMS)
- Internal information security controls system
- Policies (e.g., organizational, functional, cloud computing)
- Identification and involvement of relevant stakeholders
- Specialized compliance requirements for highly regulated industries (e.g., North American Electric Reliability Corporation/Critical Infrastructure Protection (NERC/CIP), Health Insurance Portability and Accountability Act (HIPAA), Payment Card Industry (PCI))
- Impact of distributed Information Technology (IT) model (e.g., diverse geographical locations and crossing over legal jurisdictions)
6.4 Understand implications of cloud to enterprise risk management
- Assess providers risk management programs (e.g., controls, methodologies, policies)
- Difference between data owner/controller vs. data custodian/processor (e.g., risk profile, risk appetite, responsibility)
- Regulatory transparency requirements (e.g., breach notification, Sarbanes-Oxley (SOX), General Data Protection Regulation (GDPR))
- Risk treatment (i.e., avoid, modify, share, retain)
- Different risk frameworks
- Metrics for risk management
- Assessment of risk environment (e.g., service, vendor, infrastructure)
6.5 Understand outsourcing and cloud contract design
- Business requirements (e.g., Service Level Agreement (SLA), Master Service Agreement (MSA), Statement of Work (SOW))
- Vendor management
- Contract management (e.g., right to audit, metrics, definitions, termination, litigation, assurance, compliance, access to cloud/data, cyber risk insurance)
- Supply-chain management (e.g., International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 27036)
