A.

1 Cloud Computing Definitions

A.2 Cloud Computing Roles

A. Understand Cloud Computing Concepts
A.3 Key Computing Characteristics

A.4 Building Block Technologies

B.1 Cloud Computing Activities

B.2 Cloud Service Capabilities

B.3 Cloud Service Categories

B. Describe Cloud Reference Architecture
B.4 Cloud Deployment Models

B.5 Cloud Shared Considerations

B.6 Impact of Related Technologies

C.1 Cryptography and Key Management

1 - Cloud Concepts, Architecture and Design (17%) C.2 Access Control

C.3 Data and Media Sanitisation

C. Understand Security Concepts Relevant to Cloud Computing
C.4 Network Security

C.5 Virtualisation Security

C.6 Common Threats

D.1 Cloud Secure Data Lifecycle

D.2 Cloud based Disaster Recovery (DR) and Business

Continuity (BC) planning

D. Understand Design Principles of Secure Cloud Computing D.3 Cost/Benefit Analysis

D.4 Functional Security Requirements

D5. Security Considerations for Different Cloud Categories

E.1 Verification Against Criteria

E. Evaluate Cloud Service Providers
E.2 System/Subsystem Product Certifications

A.1 Cloud Data Life Cycle Phases

A. Describe Cloud Data Concepts
A.2 Data Dispersion

B.1 Storage Types

B. Design and Implement Cloud Data Storage Architectures
B.2 Threats to Storage Types

C.1 Encryption and Key Management

C.2 Hashing

C.3 Masking

C. Design and Apply Data Security Technologies and Strategies C.4 Tokenisation

C.5 Data Loss Prevention (DLP)

C.6 Data Obfuscation

C7. Data De-identification

D.1 Structured Data

D. Implement Data Discovery
2 - Cloud Data Security (19%) D.2 Unstructured Data

E.1 Mapping

E. Implement Data Classification E.2 Labeling

E.3 Sensitive data

F.1 Objectives
F. Design and Implement Information Rights Management (IRM)
F.2 Appropriate Tools

G.1 Data Retention Policies

G.2 Data Deletion Procedures and Mechanisms

G. Plan and Implement Data Retention, Deletion and Archiving
Policies
G.3 Data Archiving Procedures and Mechanisms

G.4 Legal Hold

H.1 Definition of Event Sources and Requirement of Identity

Attribution
H. Design and Implement Auditability, Traceability and
Accountability of Data Events H.2 Logging, Storage and Analysis of Data Events

H.3 Chain of Custody and Non-repudiation

A.1 Physical Environment

A.2 Network and Communications

A.3 Compute
A. Comprehend Cloud Infrastructure Components
A.4 Virtualisation

A.5 Storage

A.6 Management Plan

B.1 Logical Design

B. Design a Secure Data Center B.2 Physical Design

B.3 Environmental Design

C.1 Risk Assessment and Analysis

C.2 Cloud Vulnerabilities, Threats and

Attacks
C. Analyze Risks Associated with Cloud Infrastructure
3 - Cloud Platform and Infrastructure Security (17%) C.3 Virtualization Risks

C.4 Counter-measure Strategies

D.1 Physical and Environmental Protection

D.2 System and Communication Protection

D. Design and Plan Security Controls D.3 Virtualization Systems Protection

D.4 Identification, Authentication and Authorization

in Cloud Infrastructure

D.5 Audit Mechanismsn

E.1 Risks Related to the Cloud Environment

E.2 Business Requirements

E. Plan Disaster Recovery (DR) and Business Continuity (BC) E.3 Business Continuity/Disaster Recovery
Strategy

E.4 Creation, Implementation and Testing

of Plan

A1. Cloud Development Basics

A. Advocate Training and Awareness for Application Security A2. Common Pitfalls

A3. Common Cloud Vulnerabilities

B1. Business Requirements

B. Describe the Secure Software Development Life Cycle
(SDLC) Process
B2. Phases and Methodologies

C1. Avoid Common Vulnerabilities During

Development

C2. Cloud-specific Risks

C. Apply the Secure Software Development Life Cycle (SDLC) C3. Quality Assurance

C4. Threat Modeling

C5. Software Configuration Management and

Versioning

D1. Functional Testing

D. Apply Cloud Software Assurance and Validation
D2. Security Testing Methodologies
4. Cloud Application Security (17%)
E1. Approved Application Programming Interfaces (API)

E2. Supply-chain Management

E. Use Verified Secure Software
E3. Third Party Software Management

E4.Validated Open Source Software

F1. Supplemental Security components

F2. Cryptography
F. Comprehend the Specifics of Cloud Application Architecture
F3. Sandboxing

F4. Application Virtualization and Orchestration

CCSP Domains
August 2019 G1. Federated Identity

G2. Identity Providers

G. Design Appropriate Identity and Access Management (IAM) G3. Single Sign-On (SSO)
Solutions
G4. Multi-factor Authentication

G5. Cloud Access Security Broker (CASB)

A1. Hardware Specific Security Configuration Requirements

A2. Installation and Configuration of Virtualization Management

Tools
A. Implement and Build Physical and Logical Infrastructure for
Cloud Environment A3.Virtual Hardware Specific Security Configuration
Requirements

A4. Installation of Guest Operating System (OS) Virtualization

Toolsets

B1. Configure Access Control for Local and Remote

Access

B2. Secure Network Configuration

B3. Operating System (OS) Hardening Through the

B. Operate Physical and Logical Infrastructure for Cloud Application of Baselines
Environment
B4. Availability of Stand-Alone Hosts

B5. Availability of Clustered Hosts

B6. Availability of Guest Operating System (OS)

C1. Access Controls for Remote Access

C2. Operating System (OS) Baseline Compliance

Monitoring and Remediation

C3. Patch Management

C4. Performance and Capacity Monitoring

C. Manage Physical and Logical Infrastructure for Cloud
Environment
C5. Hardware Monitoring

C6. Configuration of Host and Guest Operating

System (OS) Backup and Restore Functions

C7. Network Security Controls

C8. Management Plan

D1. Change Management

D2. Continuity Management

5. Cloud Security Operations (17%)
D3. Information Security Management

D4. Continual Service Improvement Management

D5. Incident Management

D6. Problem Management

D. Implement Operational Controls and Standards
D7. Release Management

D8. Deployment Management

D9. Configuration Management

D10. Service level Management

D11. Availability Management

D12. Capacity Management

E1. Forensic Data Collection Methodologies

E. Support Digital Forensics E2. Evidence Management

E3. Collect, Acquire and Preserve Digital Evidence

F1.Vendors

F2. Customers

F. Manage Communication with Relevant Parties F3. Partners

F4. Regulators

F5. Other Stakeholders

G1. Security Operations Center (SOC)

G2. Monitoring of Security Controls

G. Manage Security Operations
G3. Log Capture and Analysis

G4. Incident Management

A1. Conflicting International Legislation

A2. Evaluation of Legal Risks Specific to Cloud

Computing
A. Articulate Legal Requirements and Unique Risks within the
Cloud Environment A3. Legal Framework and Guidelines

A4. eDiscovery

A5. Forensics Requirements

B1. Difference Between Contractual and Regulated Private Data

B2. Country-Specific Legislation Related to Private Data

B. Understand Privacy Issues
B3. Jurisdictional Differences in Data Privacy

B4. Standard Privacy Requirements

C1. Internal and External Audit Controls

C2. Impact of Audit Requirements

C3. Identify Assurance Challenges of Virtualization

and Cloud

C4. Types of Audit Reports

C5. Restrictions of Audit Scope Statements

C6. Gap Analysis

C. Understand Audit Process, Methodologies, and Required C7. Audit Planning

Adaptations for a Cloud Environment
C8. Internal Information Security Management System (ISMS)
6. Legal, Risk and Compliance (13%)
C9. Internal Information Security Controls System

C10. Policies

C11. Identification and Involvement of Relevant

Stakeholders

C12. Specialized Compliance Requirements for

Highly-Regulated Industries

C13. Impact of Distributed Information Technology

(IT) Model

D1. Assess Providers Risk Management Programs

D2. Difference Between Data Owner/Controller vs.

Data Custodian/Processor

D3. Regulatory Transparency Requirements

D. Understand Implications of Cloud to Enterprise Risk
Management D4. Risk Treatment

D5. Different Risk Frameworks

D6. Metrics for Risk Management

D7. Assessment of Risk Environment

E1. Business Requirements

E2.Vendor Management
E. Understand Outsourcing and Cloud Contract Design
E3. Contract Management

E4. Supply-chain Management