PECB Lead Cloud Sec key terms

A model for enabling on-demand network access to a shared pool of configurable computing resources that can be rapidly provisioned and released with minimal management effort or provider interaction.

The five defining traits of cloud computing: on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service. A service lacking any of these is not truly cloud.

The classification of what the provider delivers: Infrastructure as a Service, Platform as a Service, or Software as a Service. It determines how responsibility is divided between customer and provider.

The arrangement of the cloud environment: public, private, community, or hybrid. It describes who owns and shares the infrastructure and where workloads physically run.

The division of security duties between cloud provider and cloud customer. The provider secures the underlying infrastructure; the customer secures data, identities, configurations, and workloads within its control.

The organization or individual that uses cloud services under a contract with a cloud service provider. It retains accountability for its own data and for the controls it must operate.

The entity that makes cloud services available to customers, operating the infrastructure and platform and assuming the security duties assigned to it in the shared responsibility model.

A design where one physical instance of an application or infrastructure serves several customers, with logical isolation between them. Weak isolation can expose one tenant's data to another.

The contract between provider and customer covering scope, service levels, security obligations, data location, audit rights, and exit terms. It is the primary evidence of agreed controls.

Top management's documented direction on protecting information, stating objectives, principles, and mandatory requirements. In cloud contexts it must address provider dependence and data location.

Information that must be controlled and maintained, including policies, procedures, records, and evidence of results. It must be created, updated, protected, and available where needed.

A document listing the applicable security controls, why each is included or excluded, and their implementation status. It links risk treatment decisions to the control set actually operated.

The organization's long-term plan for protecting information in cloud environments, aligning business goals, risk appetite, architecture choices, and control investment across providers.

The decision-making structures and rules that direct how cloud services are approved, used, monitored, and retired, ensuring alignment with policy and legal obligations.

Cloud services or applications adopted by staff without IT or security approval. It bypasses controls and visibility, creating unmanaged data exposure and compliance gaps.

The systematic identification, analysis, and evaluation of risks arising from cloud use, considering provider dependency, data sensitivity, exposure, and loss of direct control.

The amount and type of risk an organization is willing to accept in pursuit of its objectives. It guides which cloud services and data classifications are permissible.

Selecting and applying options to address assessed risk: mitigate with controls, transfer through contract or insurance, avoid the activity, or accept the residual level with approval.

The risk that remains after controls and treatment decisions have been applied. It must be compared against risk acceptance criteria and formally accepted by an accountable owner.

The exposure created when critical services rely on a cloud provider's continuity, security, or commercial decisions. It includes lock-in, outage, and abrupt contract termination scenarios.

A situation where moving data or workloads to another provider is technically or commercially difficult, reducing negotiating power and increasing concentration risk.

A documented plan for retrieving data, migrating services, and terminating a cloud contract securely, including formats, timeframes, and deletion confirmation.

The ability to move data between providers in a usable format without loss or excessive cost. It is a key contractual and architectural safeguard against lock-in.

Risk introduced through providers, subcontractors, and fourth parties involved in delivering a cloud service, including their security posture and their own dependencies.

An international standard giving cloud-specific guidance and additional controls for both cloud service providers and customers, extending the ISO/IEC 27002 control set.

An international standard for protecting personally identifiable information in public clouds acting as processors, providing additional controls and guidance for PII protection.

A safeguard that addresses cloud-only concerns such as virtual machine hardening, tenant separation, administrative access to customer systems, and provider monitoring obligations.

The technical and procedural measures that prevent one cloud tenant from accessing another tenant's data, systems, or traffic, including network, storage, and virtualization separation.

A control point placed between users and cloud services that enforces policy for visibility, data protection, threat detection, and access control across sanctioned and unsanctioned services.

A third party engaged by a cloud provider to process data or deliver part of the service. Customers need transparency, approval rights, and equivalent security obligations.

A structured, ongoing effort to build staff knowledge and behavior that protect information, adapted to cloud risks such as data sharing, personal accounts, and service adoption.

Planned instruction that develops the specific skills people need for their role, such as secure cloud configuration, incident reporting, or contract review.

The defined responsibilities for cloud protection, including cloud service owner, security architect, platform administrator, data owner, and risk or compliance functions.

A single or series of unwanted or unexpected cloud security events that have a significant probability of compromising business operations and threatening information security.

Documented procedures defining how incidents are detected, reported, contained, eradicated, and recovered, including the provider's role and contact paths in cloud environments.

The formal communication of a security incident to affected parties, regulators, or customers within required timeframes, including the provider's duty to inform the customer.

The advance preparation that lets an organization collect and preserve admissible evidence, including logging arrangements, retention periods, and provider cooperation commitments.

The continuous collection and analysis of logs, metrics, and alerts to detect control failures, suspicious behavior, and incidents across cloud and on-premises environments.

Planned verification of cloud controls through configuration review, vulnerability assessment, penetration testing, and control audits, conducted within provider testing rules.

The recurring cycle of measuring performance, identifying gaps, and correcting or enhancing controls so the cloud security management system keeps pace with changing risk.