Cloud security awareness, training, roles, and responsibilities
Domain 5 tests whether awareness, training and role clarity actually reduce cloud risk. The exam expects role-based programmes, competence records and clear accountability across customer, provider and partner staff.
Core rules and concepts
- Awareness for all staff: acceptable use, phishing, data handling, shadow IT, incident reporting and shared responsibility. It must reflect current approved services and exceptions.
- Role-based training: developers secure APIs, secrets and CI/CD; administrators handle identity, logging and hardening; procurement and legal cover contracts, residency, subprocessors and exit; executives own risk acceptance.
- Define roles and a RACI: data owner, cloud service owner, security architect, platform operations, CISO, procurement, legal and provider contacts. A control can be shared, but accountability must be assigned.
- Competence needs evidence: training records, assessments, relevant certifications and on-the-job evidence.
- Contractors and provider staff who touch customer data need equivalent awareness and reporting routes.
Worked example
A developer stores test data in a personal cloud drive. Root causes are unclear policy and no approved storage. Response: remove the data, report the incident, update awareness, provide approved storage, add DLP and train the team. A poster alone would not fix it.
Traps
One generic annual slide deck; no training for contractors; unclear ownership; assuming the provider trains customer staff; awareness that never mentions shadow IT or data handling.