A free, open study guide for the ISC2 Certified Cloud Security Professional (CCSP) (CCSP) exam: revision notes for every domain, side-by-side comparisons of commonly confused services, a glossary, 20 worked sample questions, and the official syllabus as a checklist with a full free lesson for every topic.
Maintained by SaveMyCert, where you can read every lesson free, practice with explained questions and take timed mock exams.
- Exam at a glance
- Exam domains
- What is in this repo
- Syllabus checklist
- How to study for CCSP
- Sample questions
- Free resources
| Exam code | CCSP |
| Level | Professional |
| Questions | 100–150 |
| Time limit | 180 min |
| Passing score | 700 / 1000 |
| Format | Adaptive (CAT), multiple choice & more |
| Exam fee | $599 |
| Valid for |
Exam details change. Always confirm them in the official ISC2 CCSP certification exam outline from ISC2.
| # | Domain | Weight | Topics |
|---|---|---|---|
| 1 | Cloud Concepts, Architecture and Design | 17% | 6 |
| 2 | Cloud Data Security | 20% | 9 |
| 3 | Cloud Platform & Infrastructure Security | 17% | 5 |
| 4 | Cloud Application Security | 16% | 7 |
| 5 | Cloud Security Operations | 17% | 6 |
| 6 | Legal, Risk and Compliance | 13% | 5 |
That is 6 domains and 38 topics. Spend your time in proportion to the weights: the heaviest domain decides more of your score than the lightest.
ISC2 publishes some weights with decimals (for example 17.3%). The figures here are rounded to add up to 100%.
| File | What it gives you |
|---|---|
| Domain 1 notes | Cloud Concepts, Architecture and Design: condensed revision notes per topic |
| Domain 2 notes | Cloud Data Security: condensed revision notes per topic |
| Domain 3 notes | Cloud Platform & Infrastructure Security: condensed revision notes per topic |
| Domain 4 notes | Cloud Application Security: condensed revision notes per topic |
| Domain 5 notes | Cloud Security Operations: condensed revision notes per topic |
| Domain 6 notes | Legal, Risk and Compliance: condensed revision notes per topic |
| Commonly confused services | Side-by-side tables of the services questions set against each other |
| Glossary | Every in-scope term and service in one sentence |
| Sample questions | 20 worked questions with answers and reasoning |
| Exam-day guide | Booking, testing options, scoring, results and retakes |
Tick each topic off once you can explain it without notes. The "Must know" facts are the ones questions turn on. Each lesson link goes to the complete, free lesson.
Weight: 17%. Cloud computing concepts and reference architecture, cloud security concepts, secure cloud design principles, evaluating providers, and AI/ML in the cloud. Official weighting 17%.
📝 Revision notes: Domain 1: Cloud Concepts, Architecture and Design
- Understand cloud computing concepts
1 (Aug-2026 outline): Cloud computing definitions; Cloud computing roles and responsibilities (e.g., cloud service customer, Cloud Service Provider (CSP), cloud service partner, cloud service broker, regulator); Essential cloud computing characteristics (e.g., on-demand self-service, broad network access, multi-tenancy, rapid elasticity and scalability, resource pooling, measured service); Building block technologies (e.g., virtualization, storage, networking, databases, orchestration).- 📖 Lesson: CCSP Cloud Computing Concepts: Definitions, Roles, Characteristics and Building Blocks
- Must know: NIST SP 800-145 defines cloud as shared, configurable resources rapidly provisioned and released with minimal management effort or provider interaction; it sets out 5 characteristics, 3 service models and 4 deployment models.
- Must know: A private cloud with self-service and metering is cloud; a service where provider staff must act on each request is not.
- Describe cloud reference architecture
2 (Aug-2026 outline): Cloud computing activities; Cloud service capabilities (e.g., application capability types, platform capability types, infrastructure capability types); Cloud service categories (e.g., Software as a Service (SaaS), Infrastructure as a Service (IaaS), Platform as a Service (PaaS)); Cloud deployment models (e.g., public, private, hybrid, community, multi-cloud); Cloud shared considerations; Impact of related technologies.- 📖 Lesson: CCSP Cloud Reference Architecture: Roles, Service Categories, Deployment Models and Shared Considerations
- Must know: ISO/IEC 17789 (now ISO/IEC 22123-3) places parties by activity, not employer: the integrator and business manager are customer sub-roles, the inter-cloud provider is a provider sub-role, and the developer, auditor and broker are partner sub-roles
- Must know: Capabilities types say what the customer can do (use the provider's apps, run its own code on provider runtimes, provision compute, storage and network); a service category can combine several types
- Understand security concepts relevant to cloud computing
3 (Aug-2026 outline): Cryptography and key management; Identity and access control (e.g., user access, privilege access, service access); Data and media sanitization (e.g., overwriting, cryptographic erase); Network security (e.g., network security groups, traffic inspection, geofencing); Virtualization security (e.g., hypervisor security, container security, ephemeral computing, serverless technology, isolation); Common cloud threats; Security hygiene (e.g., patching, baselining, immutable architecture, hardening).- 📖 Lesson: CCSP Cloud Security Concepts: Key Management, Access Control, Sanitization, Network and Virtualization Security
- Must know: Key custody decides who can decrypt: BYOK means you make the key and the provider uses it; an external key manager gives you a veto and revocation; only client-side encryption leaves the provider technically unable to decrypt, and holding keys yourself makes their availability your problem
- Must know: In envelope encryption the KEK wraps data keys; rotating the KEK re-wraps the DEKs or keeps old KEK versions for existing ones, and leaves the data untouched
- Understand design principles of secure cloud computing
4 (Aug-2026 outline): Cloud secure data lifecycle; Cloud-based business continuity (BC) and disaster recovery (DR) planning; Business Impact Analysis (BIA) (e.g., Cost-Benefit Analysis (CBA), Return On Investment (ROI)); Functional security requirements (e.g., portability, interoperability, vendor lock-in); Security considerations and responsibilities for different cloud categories (e.g., Software as a Service (SaaS), Infrastructure as a Service (IaaS), Platform as a Service (PaaS)); Cloud design patterns; DevOps security.- 📖 Lesson: CCSP Secure Cloud Design Principles: Data Lifecycle, BIA, BC/DR, Shared Responsibility and DevOps Security
- Must know: Classify at Create: every later lifecycle control reads the label; Use needs access control and monitoring (or confidential computing against the host), and Share uses DLP to decide whether data leaves and IRM to control it afterwards
- Must know: Plan Destroy at Store: data encrypted under customer-controlled keys can be crypto-shredded across every replica, and key versions must live as long as the data under them
- Evaluate Cloud Service Providers (CSP)
5 (Aug-2026 outline): Verification against criteria; System/subsystem product certifications (e.g., Common Criteria (CC), Federal Information Processing Standard (FIPS) 140-2).- 📖 Lesson: CCSP: Evaluating Cloud Service Providers, Common Criteria and FIPS 140
- Must know: Criteria come first, from regulations, data classification and risk; certifications are evidence for criteria, never the criteria
- Must know: A mandatory criterion is pass/fail: extra certifications cannot offset it, and silent evidence does not relax it
- Comprehend Artificial Intelligence (AI)/Machine Learning (ML)
6 (Aug-2026 outline): Cloud threat detection and analysis; Data source validation and verification; Security Orchestration, Automation And Response (SOAR); Ethical concerns; Regulatory requirements.- 📖 Lesson: CCSP: AI and Machine Learning in Cloud Security, SOAR and AI Regulation
- Must know: Supervised learning needs labels and reproduces known classes; unsupervised anomaly detection needs none and finds novel behaviour as "unusual", not "malicious"
- Must know: UEBA scores deviation from a learned baseline: misuse already under way during the learning window becomes normal, and a changed environment needs a new baseline
Weight: 20%. The cloud data life cycle, storage architectures, encryption, obfuscation and DLP, data discovery and classification, IRM, retention and deletion, data-event auditability, and protecting AI/ML data. Official weighting 20%.
📝 Revision notes: Domain 2: Cloud Data Security
- Describe cloud data concepts
1 (Aug-2026 outline): Cloud data life cycle phases; Data dispersion; Data flows.- 📖 Lesson: CCSP Cloud Data Concepts: Data Lifecycle Phases, Data Dispersion and Data Flows
- Must know: The lifecycle is Create, Store, Use, Share, Archive, Destroy; Store comes before Use, and Share comes before Archive.
- Must know: Create covers generating new content and altering existing content (CCSP material adds acquired data): edited data starts in Create, where ownership and classification are set.
- Design and implement cloud data storage architectures
2 (Aug-2026 outline): Storage types (e.g., long-term, ephemeral, raw storage, object storage, volume storage); Threats to storage types.- 📖 Lesson: CCSP Cloud Data Storage Architectures: Storage Types and Their Threats
- Must know: Volume, ephemeral and raw storage are block devices updated in place; object and archive storage store whole objects reached through an API.
- Must know: Ephemeral storage is, by default, lost with its instance, so it holds only disposable or regenerable data; uploads and databases need object or volume storage.
- Design and apply data security technologies and strategies
3 (Aug-2026 outline): Encryption and key management; Hashing (e.g., data integrity, non-repudiation); Data obfuscation (e.g., masking, anonymization); Tokenization; Data loss prevention (DLP); Keys, secrets and certificates management.- 📖 Lesson: CCSP Data Security Technologies: Encryption, Key Management, Hashing, Masking, Tokenization and DLP
- Must know: Each encryption control covers one data state; fix the state where the exposure is. Confidential computing protects data in use with existing code but trusts the hardware and attestation; homomorphic encryption trusts no hardware but is slow and needs redesigned computations
- Must know: Key control ladder: provider-managed, customer-managed, BYOK (imported; customer can revoke; provider services keep working), HYOK/external (keys never at the provider; customer infrastructure must stay online). Client-side encryption blinds native provider services
- Implement data discovery
4 (Aug-2026 outline): Structured data; Unstructured data; Semi-structured data; Data location.- 📖 Lesson: CCSP: Cloud Data Discovery for Structured, Unstructured and Semi-Structured Data
- Must know: Discovery comes first: locate the data and learn what it contains, then classify, then protect.
- Must know: Label-based discovery misses unlabelled and mislabelled data; metadata-based discovery is misled by names; content-based discovery is accurate but costly, so layer the three.
- Plan and implement data classification
5 (Aug-2026 outline): Data classification policies; Data mapping; Data labeling and tagging.- 📖 Lesson: CCSP: Cloud Data Classification Policies, Data Mapping and Labeling
- Must know: Classify by the impact of compromise (confidentiality, integrity, availability), legal obligations and business value, never by storage location, format or usage.
- Must know: The data owner assigns and changes the level in every service model; custodians, providers, tools and users implement it.
- Design and implement Information Rights Management (IRM)
6 (Aug-2026 outline): Objectives (e.g., data rights, provisioning, access models); Appropriate tools (e.g., issuing and revocation of certificates).- 📖 Lesson: CCSP: Information Rights Management (IRM) in the Cloud
- Must know: IRM is the control that persists with the object: encryption plus a usage policy enforced by the opening client wherever the file goes.
- Must know: A copied or forwarded protected file stays useless to anyone the policy does not include, because each open needs a license from the rights service.
- Plan and implement data retention, deletion, and archiving policies
7 (Aug-2026 outline): Data retention policies; Data deletion procedures and mechanisms; Data archiving procedures and mechanisms; Legal hold.- 📖 Lesson: CCSP: Data Retention, Deletion, Archiving and Legal Hold
- Must know: A retention schedule gives each record series a period, a trigger event, a disposition, a legal basis and an owner who reviews it periodically.
- Must know: Legal and regulatory obligations set minimum periods; the GDPR's storage limitation principle caps personal data at no longer than its purpose needs, and pseudonymized data stays in scope.
- Design and implement auditability, traceability, and accountability of data events
8 (Aug-2026 outline): Definition of event sources and requirement of event attributes (e.g., identity, Internet Protocol (IP) address, geolocation); Logging, storage and analysis of data events; Chain of custody and non-repudiation.- 📖 Lesson: CCSP: Auditability of Data Events, Chain of Custody and Non-Repudiation
- Must know: Default provider audit logs record management-plane actions; object- and row-level data events usually need logging explicitly enabled.
- Must know: In IaaS the customer logs its own applications and databases; in PaaS it enables the service's built-in audit feature; in SaaS it depends on provider APIs and contract terms, secured before go-live.
- Comprehend data protection of Artificial Intelligence (AI) and Machine Learning (ML) data
9 (Aug-2026 outline): Data set and model privacy; Data set and model security (e.g., validation, verification).- 📖 Lesson: CCSP AI and ML Data Set and Model Privacy and Security
- Must know: Embeddings, feature stores and model weights derived from sensitive data inherit at least that data's classification and access rules.
- Must know: Training a model on personal data is a new purpose: check compatibility, lawful basis and notice before any technical design. Pseudonymized data is still personal data.
Weight: 17%. Cloud infrastructure components, secure data center design, infrastructure risks, security controls, and business continuity and disaster recovery. Official weighting 17%.
📝 Revision notes: Domain 3: Cloud Platform & Infrastructure Security
- Comprehend cloud infrastructure and platform components
1 (Aug-2026 outline): Physical environment; Network and communications; Compute; Virtualization; Storage; Management plane.- 📖 Lesson: CCSP Cloud Infrastructure and Platform Components Explained
- Must know: In public cloud the provider secures facilities, hosts and media under IaaS, PaaS and SaaS; customers rely on in-scope SOC 2 Type II and ISO/IEC 27001/27017 evidence, not site visits.
- Must know: A report's assurance stops at its scope; a bridge letter extends a SOC report in time, up to the present, never to extra systems or sites.
- Design a secure data center
2 (Aug-2026 outline): Logical design (e.g., tenant partitioning, access control); Physical design (e.g., location, buy or build); Environmental design (e.g., Heating, Ventilation, and Air Conditioning (HVAC), multi-vendor pathway connectivity); Design resilient; Design resilience (e.g., power, Heating, Ventilation, and Air Conditioning (HVAC), connectivity).- 📖 Lesson: CCSP Secure Data Center Design: Tenant Partitioning, Location, HVAC, Connectivity and Resilience
- Must know: VLANs separate layer 2 but run out at 12 bits; VRFs give each tenant its own routing table (overlapping ranges, no NAT); VXLAN overlays give 24-bit segment IDs over IP but do not encrypt.
- Must know: Close VLAN hopping with access ports at the tenant edge and an unused native VLAN on trunks.
- Analyze risks associated with cloud infrastructure and platforms
3 (Aug-2026 outline): Risk assessment (e.g., identification, analysis); Cloud vulnerabilities, threats and attacks; Risk treatment strategies.- 📖 Lesson: CCSP: Cloud Infrastructure Risk Assessment, Threats and Risk Treatment
- Must know: A risk needs an asset, a threat and a vulnerability: the threat acts, the vulnerability is the weakness it uses, and the harm is the impact.
- Must know: Use qualitative ratings when data is thin or the list is long; use quantitative analysis when you have loss data and a spending decision. Many teams rate qualitatively, then quantify the top risks.
- Plan and implementation of security controls
4 (Aug-2026 outline): Physical and environmental protection (e.g., on-premises); System, storage and communication protection; Identification, authentication and authorization in cloud environments; Audit mechanisms (e.g., log collection, correlation, packet capture).- 📖 Lesson: CCSP: Planning and Implementing Cloud Infrastructure Security Controls
- Must know: Whoever controls the space implements physical security: the provider in public cloud, the operator for shared colocation infrastructure, the tenant for its own cage, the customer for its premises and edge sites.
- Must know: An assurance report covers only its stated scope; where a location cannot be secured, protect the data itself with device-bound encryption.
- Plan business continuity (BC) and disaster recovery (DR)
5 (Aug-2026 outline): Business continuity (BC) / disaster recovery (DR) strategy; Business requirements (e.g., Recovery Time Objective (RTO), Recovery Point Objective (RPO), recovery service level); Creation, implementation and testing of plan.- 📖 Lesson: CCSP: Business Continuity and Disaster Recovery Planning (RTO, RPO, RSL)
- Must know: Business continuity keeps critical functions running (people, processes, workarounds); disaster recovery restores the IT systems and data. In SaaS, the customer's own plan is mostly continuity.
- Must know: RTO is how fast service returns, RPO is how much data may be lost (measured backward), RSL is how much capacity must run in disaster mode. Copying more often moves RPO; restoring faster moves RTO; the standby's size sets RSL.
Weight: 16%. Application security awareness, the secure SDLC, cloud software assurance and validation, verified secure software, cloud application architecture, and IAM solutions. Official weighting 16%.
📝 Revision notes: Domain 4: Cloud Application Security
- Advocate training and awareness for application security
1 (Aug-2026 outline): Cloud development basics; Common pitfalls; Common cloud vulnerabilities (e.g., Open Web Application Security Project (OWASP) Top-10, Application Security Verification Standard (ASVS), Top 10 Application Programming Interface (API), Top 10 for Large Language Model Applications, SANS Top-25).- 📖 Lesson: CCSP Application Security Awareness: Cloud Development Basics, Pitfalls and the OWASP, API, LLM and CWE Top Lists
- Must know: Except in SaaS, the security of the code you deploy is yours; PaaS moves only the operating system and runtime to the provider.
- Must know: Lift-and-shift moves the code, not the perimeter it relied on; components that authenticate nobody become exposed.
- Describe the Secure Software Development Life Cycle (SDLC) process
2 (Aug-2026 outline): Business requirements; Phases and methodologies (e.g., design, code, test, maintain, waterfall vs. agile).- 📖 Lesson: CCSP Secure SDLC: Business Requirements, Phases, Waterfall vs. Agile and DevSecOps
- Must know: Security starts at requirements: the later a flaw is found, the more it costs to fix.
- Must know: Define before you design, and assess before you contract; the data owner sets the classification that drives protection requirements.
- Apply the Secure Software Development Life Cycle (SDLC)
3 (Aug-2026 outline): Cloud-specific risks (e.g., shared technology issues, Cloud Service Provider (CSP) insider threats, lack of visibility and control, legal and jurisdiction issues); Threat modeling; Avoid common vulnerabilities during development; Secure coding (e.g., Open Web Application Security Project (OWASP) Application Security Verification Standard (ASVS), Software Assurance Forum for Excellence in Code (SAFECode)); Software Configuration Management (CM) and versioning.- 📖 Lesson: CCSP Applying the Secure SDLC: Cloud Risks, Threat Modeling and Secure Coding
- Must know: The provider isolates its infrastructure; in a shared schema, cache or queue, tenant separation is application code, enforced centrally from the authenticated tenant identity.
- Must know: Against CSP insiders, encrypt sensitive fields with keys held outside the provider; where the provider must have access, make it customer-approved, time-limited and logged to the customer.
- Apply cloud software assurance and validation
4 (Aug-2026 outline): Functional and non-functional testing (e.g., Continuous Integration And Continuous Delivery (CI/CD) processes); Security testing methodologies (e.g., blackbox, whitebox, Software Composition Analysis (SCA), Interactive Application Security Testing (IAST), Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST)); Quality assurance (QA); Abuse case testing.- 📖 Lesson: CCSP: Cloud Software Assurance and Security Testing (SAST, DAST, IAST, SCA)
- Must know: Functional tests check that a feature does what it should; non-functional tests check performance, scalability, resilience, usability and security under realistic conditions.
- Must know: Load testing proves capacity at the expected peak; failover testing proves continuity when a site or component is lost, and needs an environment that has more than one.
- Use verified secure software
5 (Aug-2026 outline): Securing Application Programming Interfaces (API); Supply-chain management (e.g., vendor assessment, integrity, authenticity, licensing); Third-party software management; Validated open-source software.- 📖 Lesson: CCSP Verified Secure Software: API Security, Software Supply Chain and Open Source
- Must know: Use scoped OAuth 2.0 tokens when an API acts for a user, mutual TLS for service-to-service authentication with no shared secret, and never put credentials in URLs; rotate any key that was logged.
- Must know: Authorization is a server-side entitlement check on every object, using values the server trusts (token claims, stored records); identifiers that are hard to guess are not authorization.
- Comprehend and apply the specifics of cloud application architecture
6 (Aug-2026 outline): Supplemental security components (e.g., Web Application Firewall (WAF), Database Activity Monitoring (DAM), Extensible Markup Language (XML) firewalls, Application Programming Interface (API) gateway, load balancer); Cryptography; Sandboxing; Application virtualization and orchestration (e.g., microservices, containers, docker, Kubernetes).- 📖 Lesson: CCSP Cloud Application Architecture: WAF, Sandboxing and Kubernetes
- Must know: A WAF inspects HTTP request content and can virtually patch a known flaw, but it cannot enforce business authorization such as record ownership.
- Must know: Roll out WAF rules in detection-only mode on real traffic, tune out false positives, then block.
- Design appropriate Identity and Access Management (IAM) solutions
7 (Aug-2026 outline): Federated identity; Identity Providers (IdP); Single Sign-On (SSO); Multi-Factor Authentication (MFA); Cloud Access Security Broker (CASB); Secrets, key, and certificate management.- 📖 Lesson: CCSP Cloud IAM Design: Federation, SSO, MFA, CASB and Secrets Management
- Must know: The IdP authenticates and signs; the relying party verifies the signature with the IdP's signing certificate from metadata, and a multi-tenant app must bind each tenant to its own IdP's issuer and key.
- Must know: SAML and OpenID Connect are for sign-in; OAuth 2.0 is delegated authorization with scopes; SCIM provisions accounts.
Weight: 17%. Building, operating and maintaining cloud infrastructure, operational controls and standards, digital forensics, communication with relevant parties, and security operations. Official weighting 17%.
📝 Revision notes: Domain 5: Cloud Security Operations
- Build and implement physical and logical infrastructure for cloud environment
1 (Aug-2026 outline): Hardware specific security configuration requirements (e.g., Hardware Security Module (HSM) and Trusted Platform Module (TPM)); Secure by default; Installation and configuration of management plane tools; Virtual hardware specific security configuration requirements (e.g., network, storage, memory, Central Processing Unit (CPU), Hypervisor type 1 and 2); Installation of guest operating system (OS) virtualization toolsets.- 📖 Lesson: CCSP Building Secure Cloud Infrastructure: HSM, TPM, Secure Defaults, Virtual Hardware and Guest Tools
- Must know: HSM keys should be born inside the module as non-extractable and backed up only as wrapped blobs; whoever holds the wrapping key controls recovery.
- Must know: Tamper evident shows an intrusion afterwards; tamper responsive zeroizes keys during it, so keep another protected copy that one incident cannot reach.
- Operate and maintain physical and logical infrastructure for cloud environment
2 (Aug-2026 outline): Access controls for local and remote access; Secure network configuration; Network security controls; Operating system (OS) hardening through the application of baselines, monitoring and remediation (e.g., Windows, Linux, VMware); Patch management; Availability of clustered hosts; Availability of guest Operating System (OS); Performance and capacity monitoring; Hardware monitoring; Configuration of host and guest Operating System (OS) backup and restore functions; Management plane (e.g., scheduling, orchestration, maintenance).- 📖 Lesson: CCSP Operating Cloud Infrastructure: Access, Hardening, Patching and Availability
- Must know: Route administrative access through one hardened bastion and replace standing access with approved, expiring just-in-time grants.
- Must know: Disable SSH password authentication in favour of keys, require RDP Network Level Authentication, and federate consoles and admin tools to one identity provider with SSO.
- Implement operational controls and standards
3 (Aug-2026 outline): Change management; Continuity management; Information security management; Continual service improvement management; Incident management; Problem management; Release management; Deployment management; Configuration Management (CM); Service-level management; Availability management; Capacity management.- 📖 Lesson: CCSP Operational Controls and Standards: ITIL, ISO/IEC 20000-1 and Service Management
- Must know: ISO/IEC 20000-1 certifies a service management system and ISO/IEC 27001 an ISMS; ITIL is guidance, so organizations cannot be ITIL certified, and a certificate covers only its stated scope.
- Must know: COSO is for internal control over financial reporting, COBIT for governance of enterprise IT, CIS Controls IG1 for a prioritized starting set, NIST CSF 2.0 (with Govern) for program outcomes, and SP 800-53 baselines follow RMF categorization.
- Support digital forensics
4 (Aug-2026 outline): Forensic data collection methodologies; Evidence management; Collecting, acquiring, and preserving digital evidence.- 📖 Lesson: CCSP Cloud Digital Forensics: Evidence Collection, Preservation and Management
- Must know: Collect from most to least volatile (RFC 3227): memory and live state, temporary file systems, disk, then remote logs and archival media; an expiring log retention window is its own deadline.
- Must know: Stopping, rebooting or terminating a VM destroys memory, and stopping or terminating also wipes instance-local ephemeral disks, so capture both live with trusted tools from a clean volume and document the footprint.
- Manage communication with relevant parties
5 (Aug-2026 outline): Vendors; Customers; Partners; Regulators; Other stakeholders.- 📖 Lesson: CCSP Communication with Relevant Parties: Vendors, Customers, Partners and Regulators
- Must know: Settle who communicates, to whom, through which channel, how fast and with whose approval in a communication plan before any event, and update it whenever a system moves to a provider.
- Must know: Timeliness and control together: make approval always available (more than one empowered approver, wording agreed in advance) rather than removing sign-off.
- Manage security operations
6 (Aug-2026 outline): Security operations center (SOC); Intelligent monitoring of security controls (e.g., firewalls, Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS), honeypots, network security groups, artificial intelligence (AI)); Log capture and analysis (e.g., Security Information and Event Management (SIEM), log management, threat intelligence); Incident Response (IR); Vulnerability assessments; Penetration testing.- 📖 Lesson: CCSP Security Operations: SOC, SIEM, Incident Response and Testing
- Must know: A hybrid SOC gives round-the-clock coverage while keeping decisions and tuning in house; with any outsourced SOC, the contract must say how fast the provider escalates and what it may do without your approval.
- Must know: The customer's SOC monitors the layers the customer controls: guest OS and up in IaaS, application and platform logs in PaaS, tenant audit logs in SaaS.
Weight: 13%. Legal requirements and cloud-specific risks, privacy, audit in the cloud, enterprise risk management, and outsourcing and contract design. Official weighting 13%.
📝 Revision notes: Domain 6: Legal, Risk and Compliance
- Articulate legal requirements and unique risks within the cloud environment
1 (Aug-2026 outline): Conflicting international legislation; Evaluation of legal risks specific to cloud computing; Legal framework and guidelines; eDiscovery (e.g., International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 27050, Cloud Security Alliance (CSA) Guidance); Forensics requirements (e.g., Cloud Security Alliance (CSA), International Organization For Standardization/International Electrotechnical Commission (ISO/IEC) 27037:2012/27041:2015/ 27042:2015/27043:2015).- 📖 Lesson: CCSP Cloud Legal Requirements and Risks: Conflicting Laws, eDiscovery and Forensics
- Must know: Cloud data can be subject to the laws of the storage country, the provider's home country, every subprocessor's country, the customer's country and the data subjects' countries at once; region choice is residency, not sovereignty.
- Must know: The CLOUD Act reaches data in a US provider's possession, custody or control wherever it is stored; providers can move to quash or modify on comity grounds, and executive-agreement partners can serve qualifying orders directly on US providers.
- Understand privacy issues
2 (Aug-2026 outline): Difference between contractual and regulated private data (e.g., Protected Health Information (PHI), Personally Identifiable Information (PII)); Country-specific legislation related to private data; Jurisdictional differences in data privacy; Standard privacy requirements (e.g., International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 27018, Generally Accepted Privacy Principles (GAPP), General Data Protection Regulation (GDPR)); Privacy Impact Assessments (PIA).- 📖 Lesson: CCSP Privacy Issues: GDPR, HIPAA, PIPEDA, ISO/IEC 27018, GAPP and PIAs
- Must know: Regulated data (PII, PHI) carries statutory duties no contract can waive; contractual data (PCI DSS card data) is binding through agreements and enforced by the acquirer and card brands, not the PCI Council
- Must know: PHI depends on the holder as well as the content: covered entity or business associate only; employer-held staff records and Safe Harbor de-identified data are not PHI
- Understand audit process, methodologies, and required adaptations for a cloud environment
3 (Aug-2026 outline): Internal and external audit controls; Impact of audit requirements; Identify assurance challenges of virtualization and cloud; Types of audit reports; Restrictions of audit scope statements; Gap analysis; Audit planning; Internal Information Security Management System (ISMS); Internal information security controls system; Policies; Identification and involvement of relevant stakeholders; Specialized compliance requirements for highly-regulated industries; Impact of distributed Information Technology (IT) model.- 📖 Lesson: CCSP Cloud Audit: SOC 1, 2 and 3 Reports, SSAE, ISAE, Gap Analysis and Audit Planning
- Must know: Internal audit must be independent of what it audits and report functionally to the audit committee; only an auditor independent of the whole organisation gives assurance outsiders can rely on
- Must know: A provider's report covers the provider's controls for its scope and period; the customer still needs its own evidence, including logs it retains for its own obligations
- Understand implications of cloud to enterprise risk management
4 (Aug-2026 outline): Assess providers risk management programs (e.g., controls, methodologies, policies, risk profile, risk appetite); Difference between data roles (e.g., owner, controller, custodian, processor, stewards); Regulatory transparency requirements (e.g., breach notification, Sarbanes-Oxley (SOX), General Data Protection Regulation (GDPR)); Risk treatment (i.e., avoid, mitigate, transfer, share, accept); Different risk frameworks; Metrics for risk management; Assessment of risk environment (e.g., service, vendor, infrastructure, business).- 📖 Lesson: CCSP Enterprise Risk Management in the Cloud: Data Roles, Risk Treatment and Frameworks
- Must know: A provider can operate controls and pay for losses, but accountability for the customer's risk and data never moves to it.
- Must know: A provider's methodology is how it finds and rates risk, its risk profile is what risk it carries now, and its appetite is how much risk its leadership will take.
- Understand outsourcing and cloud contract design
5 (Aug-2026 outline): Business requirements (e.g., Service-Level Agreement (SLA), Master Service Agreement (MSA), Statement Of Work (SOW)); Vendor management (e.g., vendor assessments, vendor lock-in risks, vendor viability, escrow); Contract management (e.g., right to audit, metrics, definitions, termination, litigation, assurance, compliance, access to cloud/data, cyber risk insurance, data ownership, security requirements); Supply-chain management (e.g., International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 27036).- 📖 Lesson: CCSP Outsourcing and Cloud Contract Design: SLA, MSA, SOW, Escrow and ISO/IEC 27036
- Must know: The MSA holds the standing legal terms, each SOW defines one engagement, and the SLA sets measurable service levels and remedies; an order-of-precedence clause settles conflicts between them.
- Must know: Online documents incorporated by reference should be frozen as they stood at execution, or the provider can lower its commitments mid-term.
- Read the lesson for each topic in the checklist above, starting with the heaviest domain. Every lesson is free on the CCSP revision notes.
- Practice straight after reading. Answer CCSP practice questions on the topic you just read. Each option comes with an explanation of why it is right or wrong.
- Review what you got wrong, re-read that lesson section, and tick the topic off only when you get its questions right.
- Take a full-length CCSP mock exam under the real time limit. Aim to pass mocks comfortably before you book.
- On the last day, skim the CCSP cheat sheet instead of starting anything new.
sample-questions.md has 20 worked CCSP questions with the answer, why each option is right or wrong, and the reasoning steps.
- ISC2 CCSP certification exam outline: the official source (ISC2)
- CCSP certification overview
- CCSP revision notes: every lesson, free to read
- CCSP practice questions: with an explanation on every option
- CCSP mock exams: full-length and timed
- CCSP cheat sheet: the key facts on one page
- All certification study guides
Spotted an error or an out-of-date fact? Open an issue with the topic and a link to the official source. See CONTRIBUTING.md.
This guide is licensed under CC BY 4.0. You can reuse and adapt it, including commercially, as long as you credit SaveMyCert with a link to https://www.savemycert.com/.
This is an independent study resource. It is not affiliated with or endorsed by ISC2. ISC2 Certified Cloud Security Professional (CCSP) and CCSP are trademarks of their respective owner. Exam domains and weights are taken from the official exam guide linked above.