CCSP key terms

An organization that delivers cloud computing resources-compute, storage, network, or applications-to customers over a network, and that typically owns and operates the underlying infrastructure, platforms, or software.

A framework dividing security and compliance duties between a cloud provider and its customer. The provider secures the underlying infrastructure, while the customer secures data, identities, configurations, and workloads placed in the cloud.

An architecture in which a single instance of software or infrastructure serves multiple independent customers, with logical separation of their data and workloads rather than dedicated physical hardware for each tenant.

A cloud service model that supplies virtualized compute, storage, and networking resources on demand. The customer manages operating systems, middleware, applications, and data while the provider manages the physical infrastructure.

A condition where reliance on provider-specific APIs, formats, or services makes moving workloads to another provider costly or technically difficult, reducing negotiating leverage and complicating exit or disaster recovery.

Software that creates and runs virtual machines by abstracting physical hardware, allocating CPU, memory, and I/O among guest operating systems, and enforcing isolation between them.

The process of assigning sensitivity labels-such as public, internal, confidential, or restricted-to information so that handling, access, retention, and protection controls can be applied consistently and proportionately.

A structured approach to governing data through its phases-creation, storage, use, sharing, archiving, and destruction-ensuring appropriate controls, retention, and disposal at every stage.

Residual data left on storage media after deletion or reformatting efforts that do not truly overwrite the underlying blocks, a common risk in cloud environments where physical media is shared and abstracted.

Destroying data by permanently deleting or rotating the encryption keys that protect it, rendering ciphertext unrecoverable. This is useful in cloud storage where physical media destruction is not possible.

A scheme where a data key encrypts the data and a separate master key, held in a key management service or hardware module, encrypts the data key, simplifying rotation and access control.

Replacing sensitive values with non-sensitive substitute tokens that map back to the original data in a secured vault, reducing the exposure of regulated data in databases, logs, and applications.

Tools and policies that detect and block unauthorized movement of sensitive data across endpoints, networks, email, and cloud services, typically using classification labels, patterns, and content inspection.

Automated scanning of cloud repositories to locate sensitive data, identify exposure such as public buckets, and assess posture-giving visibility that manual inventory in dynamic cloud environments cannot provide.

A network security technique that divides a data center or cloud network into granular zones and applies allow-list rules between individual workloads, limiting lateral movement after a compromise.

A security model that grants no implicit trust based on network location and instead verifies identity, device health, and context for every request, enforcing least privilege continuously.

An arrangement in which a trusted identity provider authenticates users and shares assertions with other services-often via SAML or OpenID Connect-so credentials are not duplicated across systems.

Controls that secure, broker, and monitor high-privilege accounts and sessions-such as administrator, root, and service accounts-through vaulting, just-in-time elevation, approval workflows, and session recording.

The practice of storing, rotating, and auditing sensitive credentials such as API keys, passwords, and certificates in a dedicated protected store instead of hard-coding them in code or configuration files.

A deployment approach in which running servers or containers are never patched in place; instead, new images are built, tested, and replaced, reducing configuration drift and unverified changes.

A control point, delivered as a service or on-premises, that sits between users and cloud services to enforce policy for visibility, data protection, threat detection, and access control.

A structured analysis performed during design that identifies assets, entry points, trust boundaries, and plausible attack paths-often using frameworks such as STRIDE-so mitigations can be built in early.

Analysis of source code or binaries without executing the program to find security defects such as injection flaws, insecure defaults, and hard-coded credentials, typically embedded in the build pipeline.

Testing a running application from the outside by sending crafted requests to find exploitable issues such as authentication bypass, injection, and misconfiguration, without access to source code.

A reverse-proxy security control that inspects HTTP traffic and blocks patterns associated with common attacks, providing virtual patching and rate limiting for internet-facing applications.

An authorization framework that lets a client obtain limited, scoped access to protected resources on behalf of a user or itself by presenting tokens, without sharing the user's password.

A cloud model where the provider manages servers and scales functions automatically in response to events; customers pay per invocation and remain responsible for code, permissions, and dependency security.

A platform that centralizes log collection, correlation, and alerting across cloud and on-premises sources so security teams can detect and investigate suspicious activity in near real time.

Orchestration and automation tooling that executes predefined playbooks-enriching alerts, opening tickets, and containing threats-to reduce response time and analyst effort during incidents.

A documented, tested set of procedures defining roles, escalation paths, communication, and containment steps for detecting, eradicating, recovering from, and learning from security incidents.

The collection and analysis of evidence from cloud environments, relying on provider APIs, logs, and snapshots, while managing issues such as limited physical access, shared tenancy, and jurisdictional boundaries.

Tools that continuously assess cloud configurations against benchmarks and policy, flagging risks such as public storage, excessive permissions, and disabled logging, and often auto-remediating drift.

A chronological record documenting who collected, handled, and transferred evidence, and when, so that its integrity can be defended in disciplinary, legal, or regulatory proceedings.

RTO is the maximum acceptable downtime before a service must be restored; RPO is the maximum tolerable data loss measured in time, and both drive backup frequency and replication design.

The principle that data is subject to the laws and regulations of the country or region where it is stored or processed, which can conflict with provider operations, cross-border support access, and legal requests.

The process of identifying, preserving, collecting, and producing electronically stored information for litigation or investigation, complicated in cloud by distributed data, provider cooperation, and shared responsibility.

A directive requiring an organization to preserve all potentially relevant records, including cloud data and backups, when litigation or an investigation is reasonably anticipated, suspending normal deletion.

A US government program that authorizes cloud offerings for federal use through standardized security assessments, continuous monitoring, and a shared authorization package managed by designated agencies.

A contractual provision granting the customer-or an appointed third party-the ability to examine a provider's controls, evidence, and reports, often balanced against provider limits and reliance on independent attestations.

A contract element defining measurable service commitments such as availability, performance, support response, and remedies or credits when targets are missed.