(ISC)² CCSP – Certified Cloud Security Professional

Organizations that move workloads to the cloud without due diligence, and without training the people who run them, can expose the business to breaches, service outages, and customer impact. This CCSP course helps close that gap for the security staff responsible for cloud design, operations, and compliance.

Role fit: This course is built for experienced cloud and security practitioners. Assign it to Cloud Security Architects, Security Engineers, and Compliance Managers who are responsible for secure cloud environments. It is not an entry point for junior staff.

Risk and compliance: The course covers legal, risk, and privacy requirements, cloud audit planning and gap analysis, cloud contract design, security control resources such as ISO 27001 and the CSA Cloud Controls Matrix, and BCDR testing. These are the topics that come up in audits and provider reviews.

Time investment: Each learner completes 19 skills, with about 18.4 hours of training. Plan for steady weekly study alongside normal workloads rather than a single sprint.

Change management: The training stresses that on-premises processes must be updated for the cloud, and that users and support staff need to learn the new processes. That framing is useful for teams in the middle of a migration.

Platform support: Use Playlists to group skills by role, such as architecture and design for engineers or auditing and contracts for compliance leads. Use Team Reporting to track each learner's progress toward certification.

Cloud migrations often fail on preparation, not technology. This course covers what happens when an organization moves to the cloud without due diligence or staff training: breaches, outages, and unhappy customers. It then gives your team a structured way to avoid that path.

The course is built on scenarios IT teams face every day:

• Resilience that is configured, not assumed. Most cloud vendors do not replicate a new VM instance to a secondary environment by default. Your team learns to design redundant networks and to run phased BCDR tests, from tabletop walkthroughs to functional exercises. Tests start with single files or servers and grow in complexity, which reduces risk during testing.
• Faster, safer vulnerability response. Your team learns to identify and analyze risk, assess impact, prioritize response, and validate remediation after fixes are applied.
• Audit and compliance readiness. Your team learns to define audit objectives, scope, and metrics for ranking findings. It also covers remote access controls that compliance requirements often call for, including MFA, secure protocols like SSH and HTTPS, and session recording.
• Secure applications from the start. Developers, pen testers, and end users brainstorm and script abuse cases together. Teams also review the OWASP Top 10 and SANS Top 25 to catch common vulnerabilities before release.

The result is a security team that can evaluate cloud providers, harden workloads, and document findings with clear risk and impact context for stakeholders.

Knowledge

• Cloud deployment and service models, including when a community cloud fits shared needs such as multiple medical offices using one EMR instance
• How virtualization, hypervisors (type 1 and type 2), and multitenant shared resources create cloud-specific risks like resource exhaustion
• Data security technologies, data discovery and classification, IRM, and cryptography concepts for protecting cloud data
• Secure SDLC practices, common vulnerabilities from the OWASP Top 10 and SANS Top 25, and REST and SOAP API considerations
• Legal, risk, and privacy obligations in the cloud, along with cloud contract design and control frameworks such as supply chain risk management controls
• BCDR strategy and testing methods, from tabletop walkthroughs to functional technical exercises

Ability

• Evaluate cloud service providers and design redundancy and replication that cloud vendors do not set up by default
• Harden operating systems by enforcing password policies, removing unnecessary software, disabling unneeded services, and applying patches
• Secure remote access with multifactor authentication and encrypted communications that align with compliance requirements
• Apply vendor workarounds when patches aren't yet available, and run vulnerability remediation through change management
• Plan phased BCDR tests that start simple and validate each step to limit production risk
• Plan cloud audits by defining objectives, scope, and metrics, and write forensic reports suited to technical or executive audiences