All certifications / CCSP / Lessons
CCSP 2026 outline (effective Aug 1, 2026) lessons
Study CCSP for free
A week-by-week plan with every lesson, quizzes, checkpoint tests, a practice exam and hands-on labs.
Open the CCSP study planA week-by-week plan with every lesson, quizzes, checkpoint tests, a practice exam and hands-on labs.
Domain 1: Cloud concepts, architecture & design
- Cloud computing concepts: NIST definitions, essential characteristics and roles (customer, provider, partner, broker, regulator)
- Cloud reference architecture: IaaS, PaaS, SaaS service models and cloud service capabilities
- Cloud deployment models: public, private, community, hybrid and multi-cloud
- Shared responsibility model across service models
- Related technologies: containers, serverless, edge computing, confidential computing, DevSecOps and quantum
- AI and machine learning in the cloud: service types, use cases and security considerations
- Security concepts for cloud computing: cryptography and key management, identity, data and media sanitization, network security, virtualization security
- Design principles of secure cloud computing: secure data lifecycle, cloud-based BC/DR, BIA, cost-benefit and security patterns
- Evaluating cloud service providers: ISO/IEC 27017, CSA STAR, SOC 2, Common Criteria and FIPS 140-3
Domain 2: Cloud data security
- Cloud data concepts: cloud data lifecycle phases, data dispersion and data flows
- Cloud data storage architectures: storage types (ephemeral, raw, long-term, object, volume, database) and threats to storage
- Data security technologies: encryption and key management, hashing, data obfuscation (masking, anonymization), tokenization
- Data loss prevention (DLP) in the cloud
- Keys, secrets and certificates management: KMS, HSM, BYOK and HYOK
- Data discovery: structured, semi-structured and unstructured data, and data location
- Data classification: policies, data mapping and data labeling
- Information rights management (IRM): objectives, provisioning, access models and tools
- Data retention, deletion and archiving policies, including legal hold and crypto-shredding
- Auditability, traceability and accountability of data events
- Protecting AI and ML data: training data integrity, data poisoning, model and prompt security
Domain 3: Cloud platform & infrastructure security
- Cloud infrastructure components: physical environment, network and communications, compute, virtualization, storage and management plane
- Secure data center design: logical design, physical design, environmental design and tier levels
- Analyzing risks to cloud infrastructure and platforms: virtualization risks, countermeasures and threats
- Security controls: physical and environmental protection, system and communication protection, identification and authentication
- Securing the management plane and hypervisors: type 1 vs type 2, VM escape and isolation
- Network security in the cloud: virtual networks, security groups, microsegmentation, zero trust and VPNs
- Business continuity and disaster recovery in the cloud: strategy, RTO/RPO, plan creation and testing
- Audit mechanisms: log collection, correlation and packet capture in cloud environments
Domain 4: Cloud application security
- Training and awareness for application security: cloud development basics and common pitfalls
- Secure software development lifecycle (SDLC): phases, methodologies and threat modeling (STRIDE, DREAD, PASTA, ATASM)
- Common cloud vulnerabilities: OWASP Top 10 and SANS/CWE Top 25
- Applying the SDLC in cloud: secure coding, ASVS and software configuration management
- Cloud software assurance and validation: functional and non-functional testing, SAST, DAST, IAST, SCA, abuse cases
- Using verified secure software: approved APIs, supply chain management, third-party and open-source components
- Specifics of cloud application architecture: WAF, XML gateways, API gateways, database activity monitoring, cryptography, sandboxing, app virtualization
- Identity and access management solutions: federated identity, identity providers, SSO, MFA, CASB and secrets management
Domain 5: Cloud security operations
- Building and implementing physical and logical infrastructure: hardware security (TPM, HSM), virtualization toolsets and guest OS installation
- Operating and maintaining physical and logical infrastructure: access controls for local and remote access, secure network configuration (VLAN, TLS, DHCP, DNSSEC, VPN)
- Hardening, patch management and infrastructure as code
- Availability, clustering, performance and capacity monitoring, and backup and restore of the host and guest OS
- Implementing operational controls and standards: ITIL and ISO/IEC 20000-1 processes (change, configuration, incident, problem, release, deployment)
- Supporting digital forensics: forensic data collection methodologies, evidence management, chain of custody
- Communicating with relevant parties: customers, vendors, partners, regulators and other stakeholders
- Security operations: SOC, intelligent monitoring of security controls, log capture and analysis (SIEM), incident management and vulnerability assessments
- Using AI and ML in security operations: anomaly detection, automation and their limits
Domain 6: Legal, risk & compliance
- Legal requirements and unique risks in the cloud: conflicting international law, eDiscovery (ISO/IEC 27050, CSA guidance) and forensic requirements
- Privacy issues: contractual vs regulated private data, country-specific laws (GDPR, HIPAA, GLBA), jurisdictional differences and privacy impact assessments
- Audit process, methodologies and adaptations for cloud: internal vs external audit, assurance challenges of virtualization, SOC reports, gap analysis, audit planning
- Implications of cloud for enterprise risk management: data owner/controller vs custodian/processor, regulatory transparency, risk treatment
- Risk frameworks and metrics: ISO/IEC 31000, ENISA cloud risk guidance, NIST SP 800-37, and assessing a provider's risk management
- Outsourcing and cloud contract design: business requirements (SLA, MSA, SOW), vendor management and supply chain management (ISO/IEC 27036)
- Policies for cloud: organizational and functional policies, and cloud computing policies
- AI regulation and ethics in the cloud: regulatory requirements, bias, transparency and accountability
- Specialized compliance requirements: PCI DSS, FedRAMP, HIPAA, NERC CIP and certification scope