PECB Lead Cloud Sec study plan
PECB Lead Cloud Sec · Give each week a clear focus.
8 weeks · About 6 hours per week
Fundamental principles and concepts of cloud computing & Cloud computing security risk management
Define the NIST essential characteristics, service models (IaaS, PaaS, SaaS), and deployment models (public, private, community, hybrid, multi-cloud) and classify five real-world services against them
Explain the shared responsibility model and map which controls shift to the customer for each service model
Distinguish cloud-specific risk drivers (multi-tenancy, elasticity, loss of physical control, data remanence, jurisdiction) from traditional on-premise risks
Build a risk register skeleton using ISO/IEC 27005 structure (asset, threat, vulnerability, likelihood, impact, treatment) applied to one cloud scenario
Your checkpoint
A two-page comparison matrix classifying five cloud services by model plus a 10-row cloud risk register with at least three risk-treatment options
Cloud computing security risk management & Fundamental principles and concepts of cloud computing
Perform a qualitative risk assessment on a hypothetical SaaS migration and justify likelihood and impact ratings
Apply the ISO/IEC 27005 treatment options (mitigate, transfer, avoid, accept) and select the appropriate option per risk
Analyze cloud supply-chain and subcontractor risk, including fourth-party dependencies and concentration risk
Identify legal and regulatory obligations (data residency, GDPR-style transfer rules, breach notification) that constrain risk decisions
Your checkpoint
A completed risk assessment report for the SaaS migration with a risk treatment plan and a residual-risk sign-off statement
Information security policy for cloud computing and documented information management & Cloud computing security risk management
Draft a cloud security policy that states scope, objectives, roles, and acceptable use in alignment with ISO/IEC 27001 clause 5.2 and Annex A 5.1
Define the documented-information set a cloud program needs (policy, cloud service inventory, risk register, supplier register, control applicability statement)
Establish document control rules: versioning, ownership, review cycles, approval authority, and retention
Integrate cloud risk appetite and tolerance statements into the policy so treatment decisions are traceable
Your checkpoint
A one-page cloud security policy plus a document-control register listing at least eight required records with owners and review dates
Cloud-specific controls based on ISO/IEC 27017 and ISO/IEC 27018 and best practices & Information security policy for cloud computing and documented information management
Interpret the ISO/IEC 27017 cloud-specific controls and explain how they extend ISO/IEC 27002, including the cloud services customer and provider relationship clauses
Interpret the ISO/IEC 27018 controls for protecting personally identifiable information in public cloud processing
Produce a control applicability statement that maps 27017 and 27018 controls to the policy from week 3 and flags gaps
Explain the roles of cloud service customer, cloud service provider, and cloud service partner and assign control ownership per role
Your checkpoint
A control applicability matrix covering at least 15 cloud-specific controls with owner, implementation status, and evidence source
Cloud security awareness, training, roles, and responsibilities & Cloud-specific controls based on ISO/IEC 27017 and ISO/IEC 27018 and best practices
Define cloud security roles (CISO, cloud security architect, platform owner, data owner, service manager) and assign RACI responsibilities
Design a role-based awareness and training curriculum differentiated for engineers, managers, and all staff
Write learning objectives and assessment questions for two training modules (shared responsibility and secure configuration)
Identify competency evidence and training-record requirements that satisfy auditor expectations
Your checkpoint
A RACI chart for cloud security activities plus a training plan with modules, audiences, objectives, and completion-tracking method
Cloud security incident management & Cloud security awareness, training, roles, and responsibilities
Define cloud incident categories and severity levels, accounting for provider-side events that the customer cannot directly observe
Design an incident response process aligned with ISO/IEC 27035 phases: prepare, detect and report, assess and decide, respond, learn
Specify contractual and communication interfaces with the cloud provider during an incident, including notification timelines and escalation contacts
Draft tabletop exercise scenarios for data exposure through misconfigured storage and for provider service outage
Your checkpoint
A cloud incident response plan with severity matrix, escalation paths, provider notification requirements, and two tabletop scenarios
Cloud security testing, monitoring, and continual improvement & Cloud security incident management
Select monitoring sources for cloud environments: provider-native logging, configuration and posture monitoring, identity and access telemetry, and cost anomaly signals
Design a security testing program covering vulnerability management, configuration review, and provider-permitted penetration testing constraints
Define key performance and key risk indicators with thresholds that trigger review
Link incident lessons learned from week 6 into corrective actions and monitoring rule updates
Your checkpoint
A monitoring and testing plan with at least six indicators, their thresholds, data sources, and review frequency, plus a corrective-action log template
Cloud security testing, monitoring, and continual improvement & Information security policy for cloud computing and documented information management
Run a gap assessment of the full cloud management system against domains 1 through 7 and score maturity per domain
Produce a continual improvement plan with prioritized actions, owners, and target dates
Consolidate all prior deliverables into an evidence index that an auditor or assessor could follow
Complete a timed practice examination and analyze wrong answers by domain to target final review
Your checkpoint
A gap assessment and improvement plan with a consolidated evidence index covering all seven domains
Milestones
Week 2: You can explain the shared responsibility model and justify each rating in your risk register without notes; risk treatment options are correctly matched to five sample risks
Week 4: Your control applicability matrix cites the correct ISO/IEC 27017 or 27018 control for at least 12 of 15 entries and assigns ownership to the right cloud role
Week 6: You can walk through an incident from detection to lessons learned, naming the provider notification point and the evidence you would request
Week 8: Practice exam score is at least 75 percent overall with no domain below 60 percent, and every weak domain has a named corrective action