PCI Cloud Compliance Professional (PCCP) study plan

Map every PCI DSS v4.0 requirement group to the cloud asset that satisfies or supports it, noting which are provider-owned, customer-owned, or shared.

Define the cardholder data environment boundary for two reference architectures (IaaS three-tier and serverless/PaaS) and write down what falls inside versus outside.

Distinguish cardholder data, sensitive authentication data, and account data from adjacent data (telemetry, logs, backups) and state where each can legitimately appear.

Explain how scope reduction techniques (tokenization, P2PE-style point-of-interaction controls, segmentation) change the assessment boundary.

Build a responsibility matrix that assigns each PCI DSS v4.0 requirement to provider, customer, or shared for at least three service models (IaaS, managed Kubernetes, SaaS payments).

Interpret what a provider's Attestation of Compliance and responsibility summary do and do not transfer to the customer's own compliance.

Identify the evidence a customer must independently produce when the provider only covers the underlying infrastructure.

List the questions to ask a cloud provider about scope, segmentation options, and evidence availability before signing.

Design a segmented architecture that isolates the CDE using security groups, network ACLs, private subnets, and a controlled egress path, and justify each control against a specific requirement.

Compare segmentation approaches (account/virtual-network isolation, host-based controls, microsegmentation) and state the evidence each requires to be accepted as scope-reducing.

Select encryption in transit and at rest for each data store in the reference architecture, including key custody options (provider-managed, customer-managed, external key manager, HYOK).

Document key management lifecycle decisions: rotation cadence, separation of duties, key access authorization, and crypto period justification.

Implement least-privilege access design for the CDE: role definitions, just-in-time elevation, break-glass accounts, and prohibition of shared credentials.

Specify authentication requirements including multi-factor authentication for all access into the CDE, plus the v4.0 expectation for MFA on non-console administrative access.

Configure and verify audit logging for privileged actions, key management operations, and data access, and prove logs are protected from tampering.

Reconcile the identity provider, cloud IAM, and workload identity layers so no orphaned or over-privileged principal remains.

Define the vulnerability scan cadence, internal versus external scan obligations, and the qualification criteria a scanning vendor must meet.

Establish a patch management timeline keyed to risk ranking, and show how to handle provider-managed components versus customer-managed instances and containers.

Build a secure baseline for at least two resource types (compute image and managed database) with the hardening settings traced to requirements.

Describe how to handle container and serverless inventory, since short-lived workloads break traditional asset tracking.

Design a logging pipeline that centralizes CDE logs into an immutable, time-synchronized store with defined retention and review cadence.

Write an incident response plan section covering cloud-specific scenarios: compromised access keys, exposed storage bucket, and provider-side outage.

Assemble the evidence package an assessor will request for a sampled requirement, including configuration exports, screenshots with timestamps, and change tickets.

Plan how to run a readiness gap assessment and how to remediate findings before a formal Report on Compliance engagement.

Draft a governance structure that assigns accountability for PCI DSS in the cloud: policy owners, approval flows, and annual review triggers.

Evaluate third-party service providers using a documented due-diligence process that includes their compliance status, breach history, and contractual security obligations.

Write the contract clauses you need: right to audit, evidence delivery, breach notification timing, subprocessor disclosure, and data return or destruction.

Define a risk register entry format and populate it with at least five cloud-specific risks tied to requirements.

Consolidate all prior deliverables into a single scope-and-responsibility narrative that an assessor could follow without verbal explanation.

Re-test weak areas by answering practice questions across all nine domains and logging every miss with its root cause.

Rehearse explaining the difference between provider compliance and customer compliance in under two minutes.

Finalize a post-exam action list for the first 90 days of a real cloud PCI DSS program.