ISC2 Certified Cloud Security Professional

Prerequisites

Learners should have at least five years of full-time IT experience, including three years in information security and at least one year in cloud security. This course is best suited to professionals who already understand core information security concepts and want to deepen that knowledge in cloud environments through structured certification preparation. Familiarity with cloud services, governance, risk, and security operations will help learners get the most value from the course.

This course is designed for professionals with at least five years of full-time IT experience, including three years in information security and at least one year in cloud security.

Target audience

It is particularly suitable for:

• Security managers
• Systems architects
• Systems engineers
• Security architects
• Security consultants
• Security engineers
• Enterprise architects
• Security administrators

ISC2 Certified Cloud Security Professional Course Content

Module 1: Cloud Concepts, Architecture and Design

• Understand fundamental cloud computing concepts, characteristics, and technologies
• Analyse cloud reference architectures, service capabilities, and deployment models
• Evaluate cloud service models, including SaaS, PaaS, and IaaS
• Assess security responsibilities across different cloud service models
• Apply secure cloud architecture and design principles
• Evaluate Cloud Service Providers, certifications, and assurance requirements
• Understand the security implications of emerging technologies, including AI, ML, containers, edge, and confidential computing
• Apply cloud business continuity, disaster recovery, and resilience principles

Module 2: Cloud Data Security

• Understand cloud data concepts, flows, dispersion, and lifecycle management
• Design secure cloud data storage architectures
• Apply encryption, hashing, tokenisation, and data obfuscation techniques
• Implement data discovery, classification, labelling and tagging
• Manage keys, secrets, and certificates
• Apply Information Rights Management and Data Loss Prevention strategies
• Develop data retention, deletion, and archiving policies
• Implement auditability, traceability, and accountability for data events
• Apply security and privacy controls to AI and ML datasets and models

Module 3: Cloud Platform and Infrastructure Security

• Understand cloud infrastructure and platform components
• Assess physical, virtual, network, compute, storage, and management-plane security
• Design secure, resilient, and highly available cloud environments
• Analyse cloud infrastructure vulnerabilities, threats, and risks
• Implement physical, environmental, system and communication security controls
• Apply identity, authentication, and authorisation controls
• Implement security monitoring, logging, and audit mechanisms
• Develop and test business continuity and disaster recovery strategies
• Apply recovery objectives, including RTO and RPO

Module 4: Cloud Application Security

• Understand secure cloud application development principles and common vulnerabilities
• Apply the Secure Software Development Life Cycle (SDLC)
• Analyse cloud-specific application security risks
• Apply threat modelling methodologies, including STRIDE, DREAD, ATASM and PASTA
• Implement secure coding and software configuration management practices
• Apply application security testing, including SAST, DAST, IAST and SCA
• Evaluate software assurance, quality assurance, and abuse-case testing
• Secure APIs, third-party software, and software supply chains
• Apply secure cloud application architecture and orchestration
• Design appropriate Identity and Access Management (IAM) solutions
• Implement federated identity, SSO, MFA, IdP and secrets management

Module 5: Cloud Security Operations

• Build and securely configure physical and logical cloud infrastructure
• Apply secure-by-default configuration and infrastructure hardening
• Manage secure local and remote access to cloud environments
• Implement network security controls, segmentation, and secure communications
• Apply operating system, virtualisation, and patch management practices
• Monitor cloud availability, performance, capacity, and hardware
• Manage backup, restoration, orchestration, and maintenance activities
• Apply operational security controls and recognised standards
• Implement change, incident, problem, release, configuration, and service management
• Support digital forensics and preserve digital evidence
• Manage security operations, including SOC, SIEM, threat intelligence and incident response
• Apply vulnerability assessment and penetration testing practices
• Manage security communications with vendors, customers, partners, regulators, and other stakeholders

Module 6: Legal, Risk, Compliance and Cloud Governance

• Understand legal, regulatory, and jurisdictional challenges in cloud environments
• Apply data privacy requirements across different jurisdictions
• Understand contractual and regulated data requirements
• Conduct Privacy Impact Assessments and address cloud privacy risks
• Plan and adapt audit processes for cloud and virtualised environments
• Evaluate assurance reports, audit scope, and compliance requirements
• Conduct cloud-specific risk assessments and gap analyses
• Evaluate Cloud Service Provider risk management programmes
• Understand data ownership, stewardship, controller, and processor responsibilities
• Apply risk treatment strategies and risk management frameworks
• Evaluate cloud outsourcing, supplier, and supply-chain risks
• Interpret SLAs, MSAs, SOWs and key cloud contract requirements
• Assess vendor lock-in, viability, audit rights, data ownership, and termination provisions

What's included

• Expert-led instruction delivered by an authorised ISC2 instructor
• Official ISC2 student training guide
• Chapter-based quizzes to reinforce learning
• Real-world learning activities and applied scenarios
• Case studies and peer discussions

Hands-on learning

This course emphasises practical application through scenario-based and interactive learning techniques.

• Real-world scenarios reflecting cloud security challenges
• Practical exercises across all six CCSP domains
• Case studies exploring cloud risk, governance, and architecture
• Expert-led walkthroughs of complex cloud security implementations
• Peer discussions to explore multiple approaches to cloud security problems

This approach ensures learners can apply knowledge directly to cloud environments within their organisations.

Exams and assessments

This course includes a comprehensive range of assessments designed to reinforce learning and prepare learners for the CCSP certification exam.

• Official ISC2 CCSP exam aligned to six domains of the Common Body of Knowledge
• Exam duration of three hours
• Total of 100-150 multiple-choice questions
• Passing score set at 700 out of 1000

Learners will leave the course with a clear understanding of their strengths and areas for further study, ensuring a focused and effective approach to certification.