• Hardware Specific Security Configuration Requirements (e.g., Basic Input Output
• System (BIOS), settings for virtualization and Trusted Platform Module (TPM), storage controllers, network controllers)
• Installation and Configuration of Virtualization Management Tools
• Virtual Hardware Specific Security Configuration Requirements (e.g., network, storage, memory, Central Processing Unit (CPU))
• Installation of Guest Operating System (OS) Virtualization Toolsets

• Configure Access Control for Local and Remote Access (e.g., Secure Keyboard
• Video Mouse (KVM), console-based access mechanisms, Remote Desk top
• Protocol (RDP))
• Secure Network Configuration (e.g., Virtual Local Area Networks (VLAN), Transport Layer Security (TLS), Dynamic Host Configuration Protocol (DHCP), Domain Name System (DNS), Virtual Private Network (VPN))
• Operating System (OS) Hardening Through the Application of Baselines (e.g.,Windows, Linux, VMware)
• Availability of Stand-Alone Hosts
• Availability of Clustered Hosts (e.g., Distributed Resource Scheduling (DRS), Dynamic Optimization (DO), storage clusters, maintenance mode, High Availability)
• Availability of Guest Operating System (OS)

• Access Controls for Remote Access (e.g., Remote Desktop Proto col (RDP), Secure Terminal Access, Secure Shell (SSH))
• Operating System (OS) Baseline Compliance Monitoring and Remediation
• Patch Management
• Performance and Capacity Monitoring (e.g., network, compute, storage, response time)
• Hardware Monitoring (e.g., Disk, Central Processing Unit (CPU), fan speed, temperature)
• Configuration of Host and Guest Operating System (OS) Backup and Restore Functions
• Network Security Controls (e.g., firewalls, Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS), honeypots, vulnerability assessments, and network security groups)
• Management Plane (e.g., scheduling, orchestration, maintenance)

• Change Management
• Continuity Management
• Information Security Management
• Continual Service Improvement Management
• Incident Management
• Problem Management
• Release Management
• Deployment Management
• Configuration Management
• Service level Management
• Availability Management
• Capacity Management

• Forensic Data Collection Methodologies
• Evidence Management
• Collect, Acquire and Preserve Digital Evidence

• Vendors
• Customers
• Partners
• Regulators
• Other Stakeholders

• Security Operations Center (SOC)
• Monitoring of Security Controls (e.g., firewalls, Intrusion Detection Systems (IDS),
• Intrusion Prevention Systems (IPS), honeypots, vulnerability assessments, network security groups)
• Log Capture and Analysis (e.g., Security Information and Event Management (SIEM), log management)
• Incident Management

• Cloud Development Basics
• Common Pitfalls
• Common Cloud Vulnerabilities

• Business Requirements
• Phases and Methodologies

• Functional Testing
• Security Testing Methodologies

• Approved Application Programming Interfaces (API)
• Supply-chain Management
• Third Party Software Management
• Validated Open Source Software

• Supplemental Security components (e.g., Web Application Firewall (WAF), Database Activity Monitoring (DAM), Extensible Markup Language (XML)firewalls, Application Programming Interface (API) gateway)
• Cryptography
• Sandboxing
• Application Virtualization and Orchestration

• Federated Identity
• Identity Providers
• Single Sign-On (SSO)
• Multi-factor Authentication
• Cloud Access Security Broker (CASB)

• Physical Environment
• Network and Communications
• Compute
• Virtualization

• Risk Assessment and Analysis
• Cloud Vulnerabilities, Threats and Attacks
• Virtualization Risks
• Counter-measure Strategies

• Physical and Environmental Protection(e.g., on-premise)
• System and Communication Protection
• Virtualization Systems Protection
• Identification, Authentication and Authorization in Cloud Infrastructure
• Audit Mechanisms (e.g., log collection, packet capture)

• Risks Related to the Cloud Environment
• Business Requirements (e.g., Recovery Time Objective (RTO), Recovery Point Objective (RPO), Recovery Service Level (RSL))
• Business Continuity/Disaster Recovery Strategy
• Creation, Implementation and Testing of Plan

• Cloud Data Life Cycle Phases
• Data Dispersion

• Storage Types (e.g. long term, ephemeral, raw-disk)
• Threats to Storage Types

• Encryption and Key Management
• Hashing
• Masking
• Tokenization

• Structured Data
• Unstructured Data

• Mapping
• Labeling
• Sensitive data (e.g., Protected Health Information (PHI), Personally Identifiable Information (PII), card holder data)
• Data Loss Prevention (DLP)
• Data Obfuscation
• Data De-identification (e.g., anonymization)

• Objectives (e.g., data rights, provisioning, access models)
• Appropriate Tools (e.g., issuing and revocation of certificates)

• Data Retention Policies
• Data Deletion Procedures and Mechanisms
• Data Archiving Procedures and Mechanisms
• Legal Hold

• Definition of Event Sources and Requirement of Identity Attribution
• Logging, Storage and Analysis of Data Events
• Chain of Custody and Non-repudiation

• Cloud Computing Definitions
• Cloud Computing Roles (e.g., cloud service customer, cloud service provider, cloud service partner, cloud service broker)
• Key Cloud Computing Characteristics (e.g., on-demand self-service, broad network access, multi-tenancy, rapid elasticity and scalability, resource pooling, measured service)
• Building Block Technologies (e.g., virtualization, storage, networking, databases, orchestration)

• Cloud Computing Activities
• Cloud Service Capabilities (e.g., application capability types, platform capability types, infrastructure capability types)
• Cloud Service Categories (e.g., Software as a Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS))
• Cloud Deployment Models (e.g., public, private, hybrid, community)
• Cloud Shared Considerations (e.g., interoperability, portability, reversibility, availability, security, privacy, resiliency, performance, governance, maintenance and versioning, service levels and Service Level Agreements (SL A), auditability, regulatory)
• Impact of Related Technologies (e.g., machine learning, artificial intelligence

• Cryptography and Key Management
• Access Control
• Data and Media Sanitization (e.g., overwriting, cryptographic erase)
• Network Security (e.g., network security groups)
• Virtualization Security (e.g., hypervisor security, container security)
• Common Threats

• Cloud Secure Data Lifecycle
• Cloud based Disaster Recovery (DR) and Business Continuity (B C) planning
• Cost Benefit Analysis
• Functional Security Requirements (e.g., portability, interoperability, vendor lock-in)
• Security Considerations for Different Cloud Categories (e.g., Software as a Service

        (SaaS), Infrastructure as a Service (IaaS), Platform as a Service (PaaS))

• Verification Against Criteria(e.g., International Organization for Standardization/

International Electro technical Commission (ISO/IEC) 27017, Payment Card Industry

Data Security Standard (PCI DSS))

• System/subsystem Product Certifications (e.g., Common Criteria (CC), Federal

Information Processing Standard (FIPS) 140-2)