PCI Cloud Compliance Professional (PCCP) study guide
PCCP · Work through your exam, one topic at a time.
The PCI Cloud Compliance Professional (PCCP) is an independent, vendor-neutral credential for practitioners who assess, implement, or manage Payment Card Industry Data Security Standard (PCI DSS) compliance in cloud environments. It suits cloud security engineers, compliance analysts, QSAs and internal assessors, and architects who translate PCI DSS v4.0 requirements into cloud-native controls. The PCCP study guide has 9 sections and about 3,126 words.
01PCI DSS Fundamentals and Scope in Cloud Environments
This domain tests whether you can draw the cardholder data environment (CDE) boundary when the hardware belongs to someone else, and defend that boundary to an assessor. PCI DSS applies wherever cardholder data (CHD) is stored, processed or transmitted, and to every system that can impact the security of those systems.
330 words, about 2 min02Shared Responsibility and Cloud Provider Compliance (PCI DSS v4.0)
This domain tests whether you can separate what the provider proves from what you must prove, and map that to the v4.0 third-party requirements. A cloud provider is a third-party service provider (TPSP) when it stores, processes or transmits CHD on your behalf, or when it could impact the security of your CDE - hypervisor administration and key custody are the classic examples.
355 words, about 2 min03Network Segmentation, Architecture, and Cloud Security Controls
This domain tests whether you can build and prove boundaries that reduce scope, and select controls that satisfy Requirement 1. Segmentation reduces scope only when it is enforced and validated.
337 words, about 2 min04Data Protection, Encryption, and Key Management in the Cloud
This domain tests whether you can render PAN unreadable, protect it in transit, and prove that the keys are under your control. Requirement 3 requires PAN at rest to be rendered unreadable with strong cryptography and associated key-management processes (3.5.1), or by hashing, truncation or tokenization (3.4.1).
372 words, about 2 min05Identity, Access Management, and Monitoring
This domain tests least privilege, unique identity, MFA into the CDE, and the logging that proves these controls operate. Requirement 7 requires an access control model with least privilege and need-to-know (7.2.1) and role-based assignment (7.2.2).
343 words, about 2 min06Vulnerability Management, Secure Configuration, and Patching
This domain tests hardening standards, scan cadence, patch timelines, and how those apply to provider-managed services. Requirement 2 requires configuration standards for all system components, covering hardening and removal of vendor defaults (2.2), and encryption of non-console administrative access (2.2.7).
358 words, about 2 min07Logging, Monitoring, and Incident Response
This domain tests whether detection evidence would survive scrutiny, and whether your incident plan accounts for a provider-side event. Requirement 10 requires logging of individual access to CHD, administrative actions, access to logs, invalid attempts and authentication or audit-log changes (10.2), with sufficient record content (10.3) and synchronised time (10.3.3).
345 words, about 2 min08Compliance Validation, Assessments, and Evidence in Cloud
This domain tests which validation path applies, what assessors accept as evidence, and how cloud changes validation. Validation paths: a Report on Compliance (ROC) with an Attestation of Compliance (AOC) for larger merchants and service providers; a Self-Assessment Questionnaire (SAQ) for others, selected by how CHD is handled - for example SAQ A where all CHD is outsourced to validated providers, SAQ A-EP where your e-commerce pages can affect the payment page, and the D variants including SAQ D for Service Providers.
368 words, about 2 min09Governance, Risk, and Third-Party Management
This domain tests whether compliance runs as a programme with owners, reviews, risk analyses and managed providers. Requirement 12 requires a security policy reviewed at least annually (12.1), targeted risk analyses for control frequencies not specified by the standard (12.3.1) and for each customized-approach control (12.3.2), defined PCI DSS responsibilities (12.4.1), documented scope with senior management confirmation where segmentation is used (12.5.2, 12.5.3), security awareness training (12.6) and personnel screening (12.7).
318 words, about 2 min