ISC2 Certified Cloud Security Professional

A secure design makes the safe choice the default. You apply defense in depth, isolation, zero trust and resilience to cloud environments, handle multi-tenancy honestly, and weigh providers against requirements before committing.

• Cloud security design principles
• Multi-tenancy and how isolation is enforced
• Resilience: regions, zones and failure domains
• Zero trust applied to cloud workloads
• Evaluating a provider: certifications, attestations and gaps
• Cost, performance and security trade-offs
• Confidential computing and hardware-backed isolation

You build A secure reference architecture for a regulated web application, with the provider assessment behind it.

Data sprawls faster in cloud than anywhere else. You follow data through its lifecycle, discover and classify it, choose the right storage and sharing controls, and put policies in place to detect leaks.

• The data lifecycle in a cloud setting
• Data discovery and classification tooling
• Storage types and their different exposures
• Data loss prevention and egress control
• Data rights, ownership and retention
• Information rights management
• Logging access to sensitive data

You build A cloud data inventory and classification scheme for a business unit, with sharing rules.

In cloud, encryption is often the only boundary the customer fully controls. You choose where to encrypt, who holds the keys, when to tokenize or mask, and how to make deleted data unrecoverable when you cannot wipe a disk.

• Encryption in transit, at rest and in use
• Key management services and customer-managed keys
• Bring-your-own-key and hold-your-own-key models
• Tokenization, masking and anonymization
• Crypto-shredding as a disposal strategy
• Key custody, separation of duties and recovery

You build A key management design for a multi-account cloud estate, including a documented disposal procedure.

The compute, network and storage layers still need hardening, only with new tools. You secure virtualization and container platforms, design virtual networks and segmentation, and apply baselines through configuration as code.

• Hypervisor risks and virtual machine isolation
• Container images, registries and orchestration security
• Virtual networks, security groups and private connectivity
• Storage and snapshot protection
• Hardening images and baselines
• Infrastructure as code and policy as code
• Securing management planes and consoles

You build A hardened virtual network and container platform defined as code, with automated policy checks.

Identity is the perimeter in cloud. You design access with federation and least privilege, control privileged and machine identities, and keep secrets out of code and images.

• Cloud identity models and directory integration
• Federation and single sign-on across providers
• Role design and least privilege at scale
• Privileged access and break-glass accounts
• Workload and service identities
• Secrets management and rotation
• Detecting identity misuse

You build An identity design for a multi-cloud organization, with roles, federation flows and a secrets policy.

Cloud applications inherit new attack surface from APIs, services and pipelines. You build security into the lifecycle, choose the right testing at each stage, and secure microservices, serverless functions and the supply of code to production.

• Secure development lifecycle in cloud teams
• Web and API vulnerabilities and their defenses
• Static, dynamic and composition analysis in pipelines
• Microservices and serverless security patterns
• Web application firewalls and API gateways
• DevSecOps pipeline controls and signing
• Third-party and open source component risk

You build A CI/CD pipeline with security gates for a containerized service, with the findings policy that governs it.

Operations decide whether a design stays secure. You collect and analyze cloud logs, manage change and configuration drift, respond to incidents across provider boundaries, and plan recovery for provider outages.

• Logging and monitoring with provider-native and third-party tools
• Detecting misconfiguration and drift
• Change, patch and capacity management
• Incident response with provider cooperation
• Forensics in ephemeral and shared environments
• Business continuity and disaster recovery across regions and providers
• Operational runbooks and metrics

You build A cloud monitoring and incident response runbook for one production environment, with a tested recovery plan.

Data in cloud crosses borders without anyone moving. You work out which laws apply, how privacy duties pass to providers, how discovery and law enforcement requests are handled, and what contracts must say.

• Data residency, sovereignty and cross-border transfer
• Privacy duties of controllers and processors
• Electronic discovery in the cloud
• Law enforcement and government access requests
• Contract terms: service levels, liability, exit
• Breach notification obligations
• Standards for cloud privacy and security

You build A legal and privacy requirements brief for moving one data set to a provider in another jurisdiction.

A provider’s promises are not your assurance. You assess cloud risk, read audit reports with a critical eye, map controls to frameworks such as the Cloud Controls Matrix, and run ongoing oversight of providers and their sub-suppliers.

• Cloud-specific risk assessment
• Reading SOC 2 and ISO/IEC 27001 attestations critically
• The CSA Cloud Controls Matrix and control mapping
• Audit scope, evidence and shared-responsibility gaps
• Vendor lock-in, concentration and exit risk
• Ongoing provider monitoring and sub-processor oversight

You build A provider risk assessment and audit-evidence review for one critical cloud service.

Bring architecture, data, identity, operations and law into one migration. You design the target state, justify each control, plan the cutover and show how the organization will prove compliance after it has moved.

• Defining the workload and its obligations
• Selecting service model and provider
• Designing data, identity and network controls
• Planning operations, monitoring and recovery
• Mapping evidence to regulatory duties
• Cutover, validation and rollback

You build A secure migration plan for a regulated workload, with architecture, control mapping and evidence list.