CCSP Domain 1 at a Glance
The conceptual foundation — every other domain assumes you know this cold.
Exam At a Glance
Certification: CCSP — Certified Cloud Security Professional (ISC2)
Format: Computerized Adaptive Testing (CAT) — since October 2025
Questions: 100–150 (~25 unscored pretest items)
Duration: 3 hours
Passing Score: 700 / 1000 scaled
Testing: Pearson VUE (English, Chinese, German, Japanese)
Experience: 5 yrs IT (3 cybersecurity, 1 CCSP domain); CISSP waives all
New Outline: Effective August 1, 2026
🆕 What's New in the August 2026 Outline
- New subsection 1.6 — AI/ML in Cloud Security (BRAND NEW to Domain 1): cloud threat detection with AI, data source validation & verification, SOAR (Security Orchestration, Automation and Response), ethical AI concerns, AI regulatory requirements (EU AI Act, NIST AI RMF)
- Domain 4 weight shifted from 17% → 16%; Domain 5 from 16% → 17%
- OWASP LLM Top-10 added to Domain 4 (Cloud Application Security)
- AI/ML data protection added to Domain 2, subsection 2.9
- CAT format since October 2025: adaptive 100–150 questions, 3-hour exam (no longer fixed 125 questions)
★ = This page. Total = 100%. Source: ISC2 CCSP Exam Outline, August 2026.
Why Domain 1 Matters
"The conceptual foundation — every other domain assumes you know this. If you can't define a deployment model or explain the shared responsibility model cold, questions in Domains 2–6 will trip you up even when you know the security control. Start here, build fluency, then move on."
Domain 1 Subdomain Map
Domain 1 Subdomains
Click any subdomain to expand. Study in order — each builds on the last.
NIST SP 800-145 — The "5-3-4" Framework
5 Essential Characteristics: On-Demand Self-Service · Broad Network Access · Resource Pooling · Rapid Elasticity/Scalability · Measured Service (pay-per-use).
3 Service Models: IaaS (Infrastructure), PaaS (Platform), SaaS (Software).
4 Deployment Models: Public · Private · Hybrid · Community. (Multi-cloud is an architectural strategy, not an official NIST deployment model.)
Roles and Responsibilities
- Cloud Service Customer — acquires and uses cloud services; owns data classification responsibilities
- Cloud Service Provider (CSP) — builds and operates the cloud infrastructure; owns physical security
- Cloud Service Partner — provides support services (consulting, integration) related to cloud
- Cloud Service Broker — acts as intermediary, aggregating/customizing services from multiple CSPs
- Regulator — government or industry body setting compliance standards (GDPR, HIPAA, FedRAMP)
Essential Characteristics — Deeper
- On-Demand Self-Service — users provision without human interaction with the CSP
- Broad Network Access — capabilities available over the network via standard mechanisms (mobile phones, tablets, laptops)
- Multi-Tenancy / Resource Pooling — provider serves multiple consumers from shared resources; location-independent
- Rapid Elasticity — capabilities scale automatically; appear unlimited to the user
- Measured Service — resource usage is monitored, controlled, and reported (utility model)
Building Block Technologies
Shared Considerations
Key exam topics across all cloud decisions: interoperability, portability, reversibility, availability, security, privacy, resiliency, performance, governance, SLAs, auditability, regulatory compliance, outsourcing risks.
NIST SP 800-145 is the authoritative definition ISC2 uses. Know all five characteristics, three models, and four deployment models by heart — they appear directly in questions.
NIST Cloud Reference Architecture
Defines five major actors: Cloud Consumer, Cloud Provider, Cloud Auditor, Cloud Broker, Cloud Carrier. Each has distinct activities and responsibilities in the cloud ecosystem.
- Cloud Consumer — uses services; manages user access, data, applications (in IaaS/PaaS)
- Cloud Provider — provides service, manages infrastructure, handles physical security and hypervisor
- Cloud Auditor — conducts independent assessments of security controls and performance
- Cloud Broker — manages use, performance, and delivery from multiple CSPs
- Cloud Carrier — provides connectivity (network transport) between consumer and provider
CSA Enterprise Architecture
The Cloud Security Alliance EA provides a framework for secure cloud adoption across business, information, application, technology, and security layers. Aligns to the Open Group TOGAF and SABSA frameworks.
Logical vs. Physical Architecture
- Logical — abstract view: tenants, applications, APIs, services, virtual networks
- Physical — actual hardware: data centers, servers, network gear, storage arrays, power/cooling
The NIST reference architecture actors (5 of them) are a common question source. Don't confuse Cloud Broker (intermediary managing services) with Cloud Carrier (network transport provider).
Cryptography & Key Management
- Encryption at rest, in transit, and in use (confidential computing)
- Key management: HSM (Hardware Security Module), BYOK (Bring Your Own Key), HYOK (Hold Your Own Key)
- Cryptographic standards: FIPS 140-2 for module validation; AES-256, RSA-2048+, ECC
Identity and Access Control
- User access — MFA, SSO, least privilege, role-based access control (RBAC)
- Privileged access — PAM (Privileged Access Management), just-in-time access
- Service access — service accounts, API keys, OAuth, OIDC, federated identity
Data & Media Sanitization
- Overwriting — may not be feasible for cloud storage (shared, distributed media)
- Cryptographic Erase — destroy encryption keys rendering data permanently unreadable; preferred cloud method
- Physical destruction — not applicable to CSP-managed hardware
Network Security
- Security groups (virtual firewall), network ACLs, VPC segmentation
- Traffic inspection: IDS/IPS, WAF, Cloud-native security services
- Geofencing, geo-restriction of access and data residency
- Microsegmentation for zero trust architectures
Virtualization Security
- Hypervisor security — Type 1 (bare-metal) more secure than Type 2; patch aggressively
- Container security — image scanning, namespace isolation, no privileged containers
- Ephemeral computing — short-lived instances reduce attack surface; immutable infrastructure
- Serverless security — function-level permissions, event injection risks
- Isolation — logical separation between tenants is critical (multi-tenancy risk)
Common Cloud Threats
Security Hygiene
- Patching and vulnerability management at cloud scale
- Baselining and configuration management (CIS Benchmarks)
- Immutable architecture — replace don't patch in production
- Image hardening and golden AMIs / container images
Cloud Secure Data Lifecycle (6 Phases)
"Can Students Usually Score Above D?" → Create · Store · Use · Share · Archive · Destroy
- Create — data is generated; classify at creation
- Store — persist to storage; apply encryption and access controls
- Use — data in use (memory); confidential computing protects here
- Share — transmitted to users/systems; encrypt in transit (TLS)
- Archive — long-term storage; retention policies, regulatory holds
- Destroy — secure deletion / cryptographic erase; certificate of destruction
BC/DR in Cloud
- RTO (Recovery Time Objective) — how fast must you recover?
- RPO (Recovery Point Objective) — how much data loss is tolerable?
- Multi-region replication, failover, active-active vs. active-passive strategies
- Testing: tabletop, functional, full interruption exercises
BIA — Business Impact Analysis
- CBA (Cost-Benefit Analysis) — justify security investment vs. risk reduction value
- ROI — quantify security controls in financial terms
- Identify critical systems, data, dependencies, and impact of outages
Shared Responsibility Model
Cloud Design Patterns
- SANS Security Principles — least privilege, defense in depth, fail safe, complete mediation
- Well-Architected Framework — AWS/Azure/GCP pillars: security, reliability, performance, cost optimization, operational excellence
- CSA Enterprise Architecture — holistic cloud security reference for enterprise design
- Secure by Design — security integrated from the start, not bolted on
DevSecOps
- Integrate security into every phase of the CI/CD pipeline (shift left)
- Automated security testing: SAST, DAST, SCA in pipelines
- Infrastructure as Code (IaC) security scanning
- Security gates before deployment; immutable artifacts
Key Evaluation Criteria
- Compliance certifications and third-party audit reports
- Transparency: published security whitepapers, SLAs, data processing agreements
- Supply chain security: vendor due diligence, sub-processors
Key Certifications & Reports
US federal standard validating cryptographic module security. Four security levels (1–4). Required for U.S. government workloads. Level 2+ for most cloud HSM implementations.
International standard for evaluating IT product security. Defines Evaluation Assurance Levels (EAL 1–7). Used for OS, hypervisor, and security product certifications.
AICPA Trust Services Criteria report covering security, availability, processing integrity, confidentiality, privacy. Type II = historical (6–12 months of operation). Most important CSP audit report for cloud customers.
International ISMS (Information Security Management System) standard. Certification requires third-party audit and ongoing surveillance audits. Widely recognized globally.
Cloud Security Alliance Security Trust Assurance and Risk registry. Three levels: STAR Level 1 (self-assessment), Level 2 (third-party audit, maps to ISO 27001), Level 3 (continuous monitoring). Built on CSA Cloud Controls Matrix (CCM).
When the question asks about cryptographic module validation → FIPS 140-2. When it asks about historical operating effectiveness of controls → SOC 2 Type II. When it asks about a CSP registry with multiple assurance tiers → CSA STAR.
Brand New in August 2026 Outline
This entire subsection did not exist in prior CCSP exam outlines. Expect 2–3 questions specifically testing AI/ML cloud security concepts. Use the DESERT mnemonic to cover all six pillars.
Cloud Threat Detection & Analysis with AI/ML
- Behavioral analytics — baseline normal behavior; flag deviations as threats
- Anomaly detection — ML models identify outlier events in logs, network traffic, API calls
- UEBA (User and Entity Behavior Analytics) — monitor users AND systems for insider threats and compromised accounts
- AI-powered SIEM integration: real-time pattern matching at scale across cloud telemetry
Data Source Validation & Verification
- Training data integrity — validate that datasets used to train security AI models are uncontaminated
- Data poisoning prevention — adversarial manipulation of training data to bias model outputs
- Provenance tracking — know where training data came from; chain of custody for AI datasets
- Input validation for AI systems: sanitize inputs to prevent prompt injection and model manipulation
SOAR — Security Orchestration, Automation & Response
- Automated playbooks — predefined response workflows triggered automatically on security alerts
- AI-driven triage — prioritize incidents by severity, context, and business impact using ML
- Integrates SIEM, ticketing, threat intel, and remediation tools
- Reduces MTTR (Mean Time to Respond) by automating repetitive analyst tasks
Ethical Concerns
- Bias in AI security tools — models trained on biased data produce discriminatory or inaccurate threat scores
- Explainability (XAI) — security teams must understand why an AI flagged an event (black-box problem)
- Accountability — who is responsible when an AI security tool makes a wrong decision?
- Fairness — equitable application of AI-driven security controls across user populations
Regulatory Requirements
- EU AI Act — risk-based framework classifying AI systems (Unacceptable / High / Limited / Minimal risk); security-related AI may be classified high-risk
- NIST AI RMF (AI Risk Management Framework) — four functions: Govern, Map, Measure, Manage; voluntary U.S. framework for responsible AI
- Emerging AI governance — ISO/IEC 42001 (AI Management System), OECD AI Principles, national AI strategies
Data validation · Ethics · SOAR · Explainability · Regulatory compliance · Threat detection — the 6 pillars of cloud AI security (1.6).
6 Mnemonics for Domain 1
Learn these and you'll lock in the frameworks that appear on every CCSP exam.
Domain 1 Vignette Quiz
10 scenario-based questions. Select your answer, then click Next to advance.
8 Domain 1 Flashcards
Click any card to flip it. Front = term. Back = definition.
Domain 1 Readiness Assessment
Rate your confidence in each subdomain category. Your overall readiness score updates automatically.
1. Cloud Service & Deployment Models
IaaS/PaaS/SaaS boundaries, NIST 5-3-4, deployment model use cases
2. Security Design Principles & Data Lifecycle
C-S-U-S-A-D phases, BC/DR, BIA, DevSecOps, design patterns
3. Cryptography & IAM Concepts
Key management, BYOK, cryptographic erase, identity federation, PAM
4. CSP Evaluation & Compliance Certifications
FIPS 140-2, Common Criteria, SOC 2 Type II, ISO 27001, CSA STAR levels
5. AI/ML Security — Subsection 1.6 NEW
Threat detection AI, data poisoning, SOAR, ethics, EU AI Act, NIST AI RMF
Study Priority Recommendations
- Complete the assessment above to see personalized recommendations.
Official Study Resources
All links point to official sources. Verify exam details directly before registering.
-
ISC2 CCSP Certification Page
Official ISC2 page for CCSP — experience requirements, exam details, endorsement process, and member resources.
-
CCSP Exam Outline (August 2026)
The official August 2026 exam outline PDF — authoritative source for all six domain weights and subdomain content. Download and highlight subsection 1.6.
-
CSA Cloud Security Guidance
Cloud Security Alliance Security Guidance v4 — comprehensive reference for cloud security architecture and controls. Free download with registration.
-
NIST SP 800-145 — The NIST Definition of Cloud Computing
The authoritative 7-page document that defines the 5 characteristics, 3 service models, and 4 deployment models. Read it. Memorize it.
-
NIST AI Risk Management Framework (AI RMF 1.0)
Essential for subsection 1.6 — the four functions (Govern, Map, Measure, Manage) and how they apply to cloud AI security tools and deployments.
-
FlashGenius — Full CCSP Study System
Access all 6 CCSP domain study pages, adaptive flashcard decks, full-length practice exams, and AI-powered study recommendations. Free to register.