ISC2 Essentials of Cloud Certificate

Cloud comes in layers and in shapes. You compare infrastructure, platform and software services, then public, private, hybrid and multi-cloud deployments, and see in outline how virtualization and regions make them work.

• Infrastructure, platform and software as a service
• Public, private, hybrid and multi-cloud deployment
• Virtualization and containers in outline
• Regions, zones and availability
• Who manages which layer in each model
• Matching a model to a type of workload

You build A comparison chart that places five example applications on the right service and deployment model.

Cloud involves more parties than it first appears. You learn the roles of provider, customer, auditor and broker, what a broker does between an organization and its providers, and how the relationship is managed.

• The parties in a cloud arrangement
• What a cloud broker does: intermediation, aggregation, arbitrage
• Service level agreements in plain terms
• Managing a provider relationship
• Questions to ask before choosing a provider
• Exit and portability

You build A provider and broker role map for a company using three cloud services.

A move works best when the business leads and technology follows. You follow a four-stage approach, assess, plan, move and run, with business alignment as the guide at each stage and security built in from the start.

• Assessing applications and readiness
• Aligning the move to business goals
• Planning: sequence, risks and responsibilities
• Migration approaches from rehosting to rebuilding
• Running and improving after the move
• Building security into every stage

You build A staged migration plan for one application, with business goals and security steps in each stage.

Most cloud incidents trace back to ordinary mistakes. You learn the shared responsibility model, the common risks of identity, data and configuration, and the first controls that every cloud customer should have in place.

• The shared responsibility model by service type
• Identity and access: the first line of defense
• Data protection basics: encryption and backup
• Misconfiguration and how it happens
• Visibility: logs and monitoring in outline
• Compliance and privacy at a glance

You build A starter cloud security checklist for a small organization, with an owner for each item.

Security choices come with trade-offs, and no product fits every case. You practice defining a challenge, weighing options against requirements, cost and risk, and recording a decision that someone else can follow.

• Defining the security challenge clearly
• Gathering requirements and constraints
• Comparing options by risk, cost and effort
• Critical thinking and common reasoning errors
• Recording a decision and its reasons
• Reviewing a decision after it is made

You build A decision record that chooses among three solutions for one cloud security challenge.

Bring everything together in one practical document. You explain the case for cloud, choose models, plan the move in stages, set out the security basics and justify the choices for decision makers.

• Describing the company and its goals
• Choosing service and deployment models
• Planning the move in stages
• Setting security basics and responsibilities
• Writing for decision makers

You build A cloud adoption brief for a sample company, covering models, stages, security and responsibilities.