CSPCC key terms

A division of security duties between a cloud provider and its customer, where the provider secures the underlying infrastructure and the customer secures data, identities, and configuration within its control.

The lines separating IaaS, PaaS, and SaaS that determine how much operating system, runtime, and application management the customer retains versus the provider.

An architecture where one provider platform serves many customers simultaneously, requiring isolation controls so that one tenant cannot access another tenant's data or workloads.

Deliberate attempts to confirm that logical separation between customers holds, such as probing metadata services, storage endpoints, and side channels for cross-tenant leakage.

A reusable, documented pattern of components and controls that guides secure design decisions for a class of workloads before implementation begins.

A pre-configured cloud environment baseline that establishes accounts, networking, logging, and guardrails so new workloads deploy into an already governed structure.

Automated constraints that prevent or flag noncompliant resource configurations, typically enforced through policy engines rather than manual review.

A hierarchical rule set applied across accounts or projects that restricts which services and configurations teams may use, inherited downward from the root.

A catalog of security control objectives mapped to cloud provider capabilities, used to compare provider assurances against a chosen framework.

The practice of aligning internal controls, provider attestations, and regulatory requirements to one another so auditors can trace coverage without duplicate evidence.

Continuous tooling that inventories cloud resources, compares them to policy, and surfaces misconfigurations such as public buckets or overly permissive security groups.

Monitoring that identifies when deployed infrastructure diverges from its approved template or baseline, triggering alerts or automated remediation.

Expressing security and compliance rules in machine-readable files so they can be versioned, tested, and enforced automatically in pipelines and at runtime.

Static analysis of declarative infrastructure templates to catch insecure settings, such as unencrypted volumes or open ingress, before resources are created.

Trust established between an identity provider and a cloud platform so users authenticate once and receive temporary access without separate cloud credentials.

A signed XML statement from an identity provider asserting a user's identity and attributes, consumed by a service provider to grant access.

A cloud API operation that exchanges a trusted identity or credential for short-lived session credentials carrying a specific permission set.

Using one set of temporary credentials to obtain another with different or narrower permissions, common in cross-account and service-to-service access patterns.

A flaw where a trusted service is tricked into acting on a resource using its own authority on behalf of an unintended party, often via missing external identifiers.

A chain of permissions, roles, or trust relationships that lets an identity gain more authority than intended, such as modifying a role it can already pass.

Reviewing granted permissions against actual usage and job function to remove excess rights and shrink the blast radius of a compromised identity.

An identity assigned to a running service or application, rather than a human, that authenticates to cloud APIs using short-lived tokens bound to the workload.

Storing, rotating, and auditing sensitive values such as API keys and database passwords in a controlled vault instead of code or configuration files.

Encrypting data with a data key, then encrypting that data key with a longer-lived master key held in a managed key service.

Periodically replacing cryptographic keys so that exposure of an old key has limited impact, while retaining prior versions to decrypt existing data.

An encryption key the customer creates and controls in a cloud key service, allowing independent rotation, disabling, and access policy management.

Requirements that data remain stored or processed within specified geographic boundaries, driven by law, contract, or internal policy.

Assigning sensitivity labels to data so handling, encryption, retention, and access rules can be applied consistently according to value and risk.

A direct network connection between two cloud networks that routes traffic privately without traversing the public internet, subject to non-overlapping address ranges.

A central network hub that connects many cloud networks, on-premises links, and accounts, simplifying routing and inspection of inter-network traffic.

Dividing a cloud network into zones with controlled traffic paths so compromise in one area does not grant unrestricted reach into others.

A stateful, instance-level virtual firewall that permits only explicitly allowed inbound and outbound traffic for attached resources.

Compromise introduced through a dependency, build tool, or artifact so that malicious code reaches production inside otherwise legitimate software.

A machine-readable inventory of components and versions in a build, used to identify exposure when a dependency vulnerability is disclosed.

Cryptographically signing build outputs so deployment systems can verify provenance and reject tampered or unauthorized images.

Collecting and correlating cloud control-plane and data-plane events to detect malicious activity and drive a structured response.

Reviewing API audit logs for anomalous actions such as permission changes, key deletions, or unusual regions to reconstruct attacker behavior.

Actions that limit damage during an incident, such as revoking sessions, isolating workloads, or restricting network paths while preserving evidence.

A preserved copy of a disk, memory, or log source captured before remediation so investigators can analyze evidence without altering the original.

A third party engaged by a cloud provider to process customer data, which the customer must be notified of and often approve under contract.

Records such as logs, configuration exports, and provider attestation reports used to demonstrate that controls operated as described during a review period.