Organization Management
Cloud changes the org chart
Traditional separation, where a build team hands artifacts to an operations team, breaks when product teams self-provision. Expect questions on the Cloud Center of Excellence (CCoE), platform teams, cloud service owners, and federated security champions. The CCoE sets standards and enables delivery; it is not the security operations center. Distinguish accountability from responsibility: a provider may perform a control while your organization remains accountable for the outcome.
Roles to recognize
Cloud security architect, cloud security engineer, IAM administrator, FinOps analyst, procurement and vendor management, and data steward. Embedded security champions scale better than a central review gate, which becomes a bottleneck and is bypassed.
Culture and change management
The shift is from ticket-based provisioning to automated, policy-as-code provisioning with guardrails. That requires training, an acceptable-use policy, consequences for shadow IT, and change management for identity and third-party lifecycle. Personnel controls (screening, awareness training, termination procedures) appear in the CCM and are easy to overlook.
Traps
- Assuming the provider's security team will notice or fix your misconfiguration.
- Confusing the CCoE with the SOC, or governance with operations.
- Choosing answers that position security as a blocker; the exam favors enabling guardrails.
- Forgetting that organizational and human-resources controls are part of the control set.
- Treating vendor management as procurement only, ignoring ongoing assurance.
Rule of thumb
If a decision cannot be expressed as an automated guardrail, it will eventually be bypassed under delivery pressure. Encode the policy, publish the exception process, and keep the human decision for exceptions only.