1.1 Understand Cloud Computing Concepts

• Cloud Computing Definitions
• Cloud Computing Roles (e.g., cloud service customer, cloud service provider, cloud service partner, cloud service broker)
• Key Cloud Computing Characteristics (e.g., on-demand self-service, broad network access, multi-tenancy, rapid elasticity and scalability, resource pooling, measured service)
• Building Block Technologies (e.g., virtualization, storage, networking, databases, orchestration)

1.2 Describe Cloud Reference Architecture

• Cloud Computing Activities
• Cloud Service Capabilities (e.g., application capability types, platform capability types, infrastructure capability types)
• Cloud Service Categories (e.g., Software as a Service (SaaS), Infrastructure as a Service (IaaS), Platform as a Service (PaaS))
• Cloud Deployment Models (e.g., public, private, hybrid, community)
• Cloud Shared Considerations (e.g., interoperability, portability, reversibility, availability, security, privacy, resiliency, performance, governance, maintenance and versioning, service levels and Service Level Agreements (SL A), auditability, regulatory)
• Impact of Related Technologies (e.g., machine learning, artificial intelligence,

1.3 Understand Security Concepts Relevant to Cloud Computing

• Cryptography and Key Management
• Access Control
• Data and Media Sanitization (e.g., overwriting, cryptographic erase)
• Network Security (e.g., network security groups)
• Virtualization Security (e.g., hypervisor security, container security)
• Common Threats

1.4 Understand Design Principles of Secure Cloud Computing

• Cloud Secure Data Lifecycle
• Cloud based Disaster Recovery (DR) and Business Continuity (B C) planning
• Cost Benefit Analysis
• Functional Security Requirements (e.g., portability, interoperability, vendor lock-in)
• Security Considerations for Different Cloud Categories (e.g., Software as a Service (SaaS), Infrastructure as a Service (IaaS), Platform as a Service (PaaS))

1.5 Evaluate Cloud Service Providers

• Verification Against Criteria(e.g., International Organization for Standardization/ International Electro technical Commission (ISO/IEC) 27017, Payment Card Industry Data Security Standard (PCI DSS))
• System/subsystem Product Certifications (e.g., Common Criteria (CC), Federal Information Processing Standard (FIPS) 140-2)

2.1 Describe Cloud Data Concepts

• Cloud Data Life Cycle Phases
• Data Dispersion

2.2 Design and Implement Cloud Data Storage Architectures

• Storage Types (e.g. long term, ephemeral, raw-disk)
• Threats to Storage Types

2.3 Design and Apply Data Security Technologies and Strategies

Encryption and Key Management

• Hashing
• Masking
• Tokenization
• Data Loss Prevention (DLP)
• Data Obfuscation
• Data De-identification (e.g., anonymization)

2.4 Implement Data Discovery

• Structured Data
• Unstructured Data

2.5 Implement Data Classification

• Mapping
• Labeling
• Sensitive data (e.g., Protected Health Information (PHI), Personally Identifiable Information (PII), card holder data)

2.6 Design and Implement Information Rights Management (IRM)

• Objectives (e.g., data rights, provisioning, access models)
• Appropriate Tools (e.g., issuing and revocation of certificates)

2.7 Plan and Implement Data Retention, Deletion and Archiving Policies

• Data Retention Policies
• Data Deletion Procedures and Mechanisms
• Data Archiving Procedures and Mechanisms
• Legal Hold

2.8 Design and Implement Auditability, Traceability and Accountability of Data Events

• Definition of Event Sources and Requirement of Identity Attribution
• Logging, Storage and Analysis of Data Events
• Chain of Custody and Non-repudiation

3.1 Comprehend Cloud Infrastructure Components

• Physical Environment
• Network and Communications
• Compute Virtualization
• Storage
• Management Plane

3.2 Design a Secure Data Center

• Logical Design (e.g., tenant partitioning, access control)
• Physical Design (e.g. location, buy or build)
• Environmental Design (e.g., Heating, Ventilation and Air Conditioning (HVAC), multi-vendor pathway connectivity

3.3 Analyze Risks Associated with Cloud Infrastructure

• Risk Assessment and Analysis
• Cloud Vulnerabilities, Threats and Attacks Virtualization Risks
• Counter-measure Strategies

3.4 Design and Plan Security Controls

• Physical and Environmental Protection (e.g., on premise)
• System and Communication Protection
• Virtualization Systems Protection
• Identification, Authentication and Authorization in Cloud Infrastructure
• Audit Mechanisms (e.g., log collection, packet capture)

3.5 Plan Disaster Recovery (DR) and Business Continuity (BC) Risks Related to the Cloud Environment

• Business Requirements (e.g., Recovery Time Objective (RTO), Recovery Point Objective (RPO), Recovery Service Level (RSL)) Business Continuity/Disaster Recovery Strategy
• Creation, Implementation and Testing of Plan

4.1 Advocate Training and Awareness for Application Security

• Cloud Development Basics
• Common Pitfalls
• Common Cloud Vulnerabilities

4.2 Describe the Secure Software Development Life Cycle (SDLC) Process

• Business Requirements
• Phases and Methodologies

4.3 Apply the Secure Software Development Life Cycle (SDLC)

Avoid Common Vulnerabilities during Development

• Cloud-specific Risks
• Quality Assurance Threat Modeling
• Software Configuration Management and Versioning

4.4 Apply Cloud Software Assurance and Validation

• Functional Testing
• Security Testing Methodologies

4.5 Use Verified Secure Software

• Approved Application Programming Interfaces (API)
• Supply-chain Management
• Third Party Software Management
• Validated Open Source Software

4.6 Comprehend the Specifics of Cloud Application Architecture

• Supplemental Security components (e.g., Web Application Firewall (WAF), Database Activity Monitoring (DAM), Extensible Markup Language (XML) firewalls, Application Programming Interface (API) gateway)
• Cryptography
• Sandboxing
• Application Virtualization and Orchestration

4.7 Design Appropriate Identity and Access Management (IAM) Solutions

• Federated Identity
• Identity Providers
• Single Sign-On (SSO)
• Multi-factor Authentication

• Cloud Access Security Broker (CASB)

5.1 Implement and Build Physical and Logical Infrastructure for Cloud Environment

• Hardware Specific Security Configuration Requirements (e.g., Basic Input Output System (BIOS), settings for virtualization and Trusted Platform Module (TPM), storage controllers, network controllers)
• Installation and Configuration of Virtualization Management Tools
• Virtual Hardware Specific Security Configuration Requirements (e.g., network, storage, memory, Central Processing Unit (CPU))
• Installation of Guest Operating System (OS) Virtualization Toolsets

5.2 Operate Physical and Logical Infrastructure for Cloud Environment

• Configure Access Control for Local and Remote Access (e.g., Secure Keyboard Video Mouse (KVM), console-based access mechanisms, Remote Desk top Protocol (RDP))
• Secure Network Configuration (e.g., Virtual Local Area Networks (VLAN), Transport Layer Security (TLS), Dynamic Host Configuration Protocol (DHCP), Domain Name System (DNS), Virtual Private Network (VPN))
• Operating System (OS) Hardening through the Application of Baselines (e.g., Windows, Linux, VMware)
• Availability of Stand-Alone Hosts
• Availability of Clustered Hosts (e.g., Distributed Resource Scheduling (DRS), Dynamic Optimization (DO), storage clusters, maintenance mode, High Availability)
• Availability of Guest Operating System (OS)

5.3 Manage Physical and Logical Infrastructure for Cloud Environment

• Access Controls for Remote Access (e.g., Remote Desktop Proto col (RDP), Secure Terminal Access, Secure Shell (SSH))
• Operating System (OS) Baseline Compliance Monitoring and Remediation
• Patch Management
• Performance and Capacity Monitoring (e.g., network, compute, storage, response time)
• Hardware Monitoring (e.g., Disk, Central Processing Unit (CPU), fan speed, temperature)
• Configuration of Host and Guest Operating System (OS) Backup and Restore Functions
• Network Security Controls (e.g., firewalls, Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS), honeypots, vulnerability assessments, and network security groups)
• Management Plane (e.g., scheduling, orchestration, maintenance)

5.4 Implement Operational Controls and Standards (e.g., Information Technology

Infrastructure Library (ITIL), International Organization for Standardization/ International Electro technical Commission (ISO/IEC) 20000-1)

Change Management

• Continuity Management
• Information Security Management
• Continual Service Improvement Management
• Incident Management
• Problem Management

Release Management

• Deployment Management
• Configuration Management
• Service level Management
• Availability Management
• Capacity Managemen

5.5 Support Digital Forensics

• Forensic Data Collection Methodologies
• Evidence Management
• Collect, Acquire and Preserve Digital Evidence

5.6 Manage Communication with Relevant Parties

Vendors

• Customers
• Partners

Regulators

• Other Stakeholders

5.7 Manage Security Operations

• Security Operations Center (SOC)
• Monitoring of Security Controls (e.g., firewalls, Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS), honeypots, vulnerability assessments, network security groups)
• Log Capture and Analysis (e.g., Security Information and Event Management (SIEM), log management)
• Incident Management

6.1 Articulate Legal Requirements and Unique Risks within the Cloud Environment Conflicting International Legislation

• Evaluation of Legal Risks Specific to Cloud Computing
• Legal Framework and Guidelines eDiscovery (e.g., International Organization for Standardization/ International Electro technical Commission (ISO/IEC) 27050, Cloud Security Alliance (CSA) Guidance)
• Forensics Requirements

6.2 Understand Privacy Issues

• Difference between Contractual and Regulated Private Data (e. g., Protected Health Information (PHI), Personally Identifiable Information (PII))
• Country-Specific Legislation Related to Private Data (e.g., Protected Health Information (PHI), Personally Identifiable Information (PII))
• Jurisdictional Differences in Data Privacy
• Standard Privacy Requirements (e.g., International Organization for Standardization /International Electrotechnical Commission (ISO/IEC) 27018, Generally Accepted Privacy Principles (GAPP), General Data Protection Regulation (GDPR))

6.3 Understand Audit Process, Methodologies, and Required Adaptations for a Cloud Environment

• Internal and External Audit Controls
• Impact of Audit Requirements
• Identify Assurance Challenges of Virtualization and Cloud
• Types of Audit Reports (e.g., Statement on Standards for Attestation Engagements (SSAE), Service Organization Control (SOC), International Standard on Assurance Engagements (ISAE))
• Restrictions of Audit Scope Statements (e.g., Statement on Standards for Attestation Engagements (SSAE), International Standard on Assurance Engagements (ISAE))

Gap Analysis

• Audit Planning
• Internal Information Security Management System (ISMS)
• Internal Information Security Controls System
• Policies (e.g., organizational, functional, cloud computing)
• Identification and Involvement of Relevant Stakeholders
• Specialized Compliance Requirements for Highly-Regulated Industries (e.g., North American Electric Reliability Corporation/ Critical Infra structure Protection (NERC/CIP), Health Insurance Portability and Accountability Act (HIPAA), Payment Card Industry (PCI))
• Impact of Distributed Information Technology (IT) Model (e.g. , diverse geographical locations and crossing over legal jurisdictions)

6.4 Understand Implications of Cloud to Enterprise Risk Management Assess Providers Risk Management Programs (e.g., controls, methodologies, policies)

• Difference between Data Owner/Controller vs. Data Custodian/Processor (e.g., risk profile, risk appetite, responsibility)
• Regulatory Transparency Requirements (e.g., breach notification, Sarbanes-Oxley (SOX), General Data Protection Regulation Risk Treatment (i.e., avoid, modify, share, retain)
• Different Risk Frameworks
• Metrics for Risk Management
• Assessment of Risk Environment (e.g., service, vendor, infrastructure)

6.5 Understand Outsourcing and Cloud Contract Design

Business Requirements (e.g., Service Level Agreement (SLA), M aster Service Agreement (MSA), Statement of Work (SOW))

• Vendor Management
• Contract Management (e.g., right to audit, metrics, definitions, termination, litigation, assurance, compliance, access to cloud/data, cyber risk insurance)
• Supply-Chain Management (e.g., International Organization for Standardization/ International Electrotechnical Commission (ISO/IEC) 27036)