CCSP study guide
CCSP · Work through your exam, one topic at a time.
The Certified Cloud Security Professional (CCSP) is an ISC2 credential for security practitioners who design, manage and secure data, applications and infrastructure in cloud environments. ISC2 positions it around advanced technical skills applied through best practices, policies and procedures drawn from certified members and cybersecurity experts worldwide. The CCSP study guide has 6 sections and about 2,019 words.
01Cloud Concepts, Architecture and Design
NIST SP 800-145 defines cloud computing by five essential characteristics (on-demand self-service, broad network access, resource pooling, rapid elasticity, measured service), three service models (IaaS, PaaS, SaaS), and four deployment models (public, private, community, hybrid). Exam questions rarely ask you to recite these; they ask you to apply them.
353 words, about 2 min02Cloud Data Security
CCSP organizes data security around the lifecycle: create, store, use, share, archive, destroy. Every control you propose should name the lifecycle stage it protects and the data state it addresses (at rest, in transit, in use).
343 words, about 2 min03Cloud Platform and Infrastructure Security
Physical/environmental, network, compute/host, virtualization, and management plane. The management plane is the highest-value target in cloud: compromise of console credentials or API keys is effectively root over the estate, so identity, MFA, and API logging are infrastructure controls, not just application concerns.
318 words, about 2 min04Cloud Application Security
Cloud applications are built, not just deployed, so the exam tests the SDLC: requirements, threat modeling, secure design, coding, testing, deployment, operations. Threat modeling with STRIDE (spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege) enumerates risks early; rate them with a scheme such as DREAD or a risk matrix.
328 words, about 2 min05Cloud Security Operations
This domain is day-two work: logging and monitoring, SIEM correlation, configuration and change management, patching, vulnerability management, capacity and availability, and incident response. Baseline first - know what normal looks like per account, region, and workload, because cloud environments change constantly.
330 words, about 2 min06Legal, Risk and Compliance
These questions ask you to map obligations to controls. Know the shape of major regimes: GDPR (controller/processor roles, lawful basis, data subject rights, breach notification, transfer mechanisms), HIPAA (covered entity/business associate, BAA), PCI DSS (cardholder data scope, shared responsibility with the provider), SOX (financial-reporting controls), and sector privacy laws.
347 words, about 2 min