ISC2 · Full exam outline

CCSP

Certified Cloud Security Professional

Cloud security leadershipCore certification

1Cloud Concepts, Architecture and Design17%

1.1Cloud computing concepts, roles and definitions

1.2Cloud reference architecture and service models

1.3Security concepts relevant to cloud computing

1.4Design principles of secure cloud computing

1.5Evaluate cloud service providers against criteria and certifications

2Cloud Data Security20%

2.1Cloud data life cycle phases

2.2Data storage architectures and their threats

2.3Data security technologies and strategies

2.4Data discovery and classification

2.5Information rights management and data retention

2.6Auditability, traceability and accountability of data events

3Cloud Platform and Infrastructure Security17%

3.1Cloud infrastructure and platform components

3.2Design a secure data centre

3.3Risks associated with cloud infrastructure and platforms

3.4Plan and implement security controls

3.5Business continuity and disaster recovery

4Cloud Application Security17%

4.1Training and awareness in application security

4.2Secure software development life cycle

4.3Application security testing and verified secure supply chain

4.4Application architecture and cloud-specific risks

4.5Identity and access management solutions

5Cloud Security Operations16%

5.1Build and implement physical and logical infrastructure

5.2Operate and maintain physical and logical infrastructure

5.3Operational controls and standards

5.4Digital forensics and evidence handling

5.5Communication with relevant parties and the security operations centre

6Legal, Risk and Compliance13%

6.1Legal requirements and unique risks in the cloud

6.2Privacy issues and jurisdictional differences

6.3Audit process, methodologies and required adaptations

6.4Implications of cloud to enterprise risk management

6.5Outsourcing and cloud contract design

Weights are the certification body’s published values and are checked against each outline revision.