CSA CCZT study guide
CSA CCZT · Work through your exam, one topic at a time.
The Certificate of Competence in Zero Trust (CCZT) is a vendor-neutral Zero Trust training and certificate program from the Cloud Security Alliance. CSA describes it as built on foundational Zero Trust components released by CISA and NIST, CSA Research work on the Software Defined Perimeter, and guidance from Zero Trust experts including John Kindervag, credited as the founder of the Zero Trust philosophy. The CSA CCZT study guide has 7 sections and about 2,558 words.
01Zero Trust Architecture
Zero Trust Architecture (ZTA) is the structural domain of the CCZT exam: how NIST SP 800-207 turns zero trust principles into concrete components and traffic flows. Questions typically test the seven tenets, the policy engine/administrator/enforcement point split, and the deployment patterns that place enforcement near the resource.
390 words, about 2 min02Software Defined Perimeter
Software Defined Perimeter (SDP) is the CSA-originated architecture most closely associated with zero trust network access. The exam tests SDP components, the control/data plane split, Single Packet Authorization (SPA), the 'dark cloud' model, and SDP deployment variants, including the cloud-native guidance in NIST SP 800-207A.
359 words, about 2 min03Zero Trust Strategy
Zero Trust Strategy is the 'why and what' domain: aligning zero trust to business outcomes, securing executive sponsorship, and choosing a defensible sequence of changes. The exam distinguishes strategy from planning and tests the artifacts a strategy must produce-principles, scope, maturity baseline, roadmap themes, governance, and measures.
351 words, about 2 min04Zero Trust Planning
Zero Trust Planning converts strategy into an executable, resourced roadmap. The exam tests discovery, policy design, architecture decisions, pilot selection, phasing, and the NIST migration workflow.
372 words, about 2 min05Zero Trust Implementation
Zero Trust Implementation is the 'how' domain: turning plans into working controls without disrupting operations. The exam tests reference architectures, identity and device controls, enforcement placement, automation, monitoring, change management, and the metrics that show the program is real.
362 words, about 2 min06NIST and CISA Best Practices
NIST and CISA Best Practices is the standards-and-guidance domain. The exam checks whether you can map zero trust work to NIST SP 800-207, NIST SP 800-207A, NIST SP 1800-35, the NIST Cybersecurity Framework, and the CISA Zero Trust Maturity Model, and whether you know which document answers which question.
362 words, about 2 min07Zero Trust Foundational Concepts
Zero Trust Foundational Concepts is the vocabulary and principles domain. The exam tests definitions, the origin and intent of zero trust, the relationship among zero trust, ZTNA, SDP, and microsegmentation, and the core assumptions that separate zero trust from perimeter security.
362 words, about 2 min