ISC2 CCSP: key terms

Flashcards for this exam ISC2 CCSP guide Class dates

• Adequacy DecisionEuropean Commission determination that a non-EU country provides essentially equivalent data protection.Intermediate
• AnonymizationIrreversibly transforming personal data so individuals can no longer be identified by any means reasonably likely to be used.Intermediate
• Authorization BoundaryAll components of a system authorized for operation by an authorizing official, excluding separately authorized connected systems.Advanced
• Authorization to Operate (ATO)Official management decision by an authorizing official to accept the risk of operating a federal information system.Intermediate
• AWS CloudHSMAWS service providing dedicated, single-tenant hardware security modules in your VPC under your exclusive control.Advanced
• AWS Identity and Access Management (IAM)Global AWS service for controlling authentication and authorization to AWS resources through users, groups, roles and policies.Foundational
• AWS Key Management Service (AWS KMS)AWS managed service for creating and controlling cryptographic keys used to encrypt data across AWS services.Intermediate
• Azure Key VaultAzure service for securely storing and controlling access to secrets, encryption keys and certificates.Intermediate
• Bring Your Own Key (BYOK)Practice of generating encryption keys on premises (often in an HSM) and importing them into a cloud key management service.Advanced
• Broad Network AccessNIST cloud characteristic: capabilities are available over the network and accessed through standard mechanisms from diverse client devices.Foundational
• ChargebackAllocating and internally billing cloud costs to the business units or teams that consumed the resources.Foundational
• CIS BenchmarksConsensus-based secure configuration guides for operating systems, cloud platforms, applications, and devices.Foundational
• Cloud Access Security Broker (CASB)Security policy enforcement point between users and cloud services that provides visibility, compliance, data security and threat protection.Intermediate
• Cloud AuditorIndependent party that assesses cloud services for security controls, privacy impact, performance and compliance.Intermediate
• Cloud BurstingHybrid pattern where an application runs on premises and overflows to public cloud capacity when demand spikes.Intermediate
• Cloud ComputingDelivery of on-demand computing resources such as servers, storage, databases and software over a network with pay-as-you-go pricing.Foundational
• Cloud Controls Matrix (CCM)Cloud Security Alliance cybersecurity control framework for cloud computing, mapped to major standards and regulations.Intermediate
• Cloud ForensicsForensic investigation of incidents in cloud environments, relying on provider logs, snapshots and APIs.Advanced
• Cloud Infrastructure Entitlement Management (CIEM)Discipline and tools that manage identities and permissions in cloud environments to enforce least privilege.Advanced
• Cloud MisconfigurationIncorrect or insecure setting of a cloud resource, such as public storage or overly permissive access, that creates security risk.Foundational
• Cloud PortabilityAbility to move applications and data between cloud providers or between cloud and on premises with minimal rework.Intermediate
• Cloud Security Posture Management (CSPM)Tools that continuously assess cloud configurations against best practices and compliance frameworks to detect and fix misconfigurations.Intermediate
• Cloud Service Broker (CSB)Intermediary that aggregates, integrates or customizes cloud services from multiple providers on behalf of customers.Intermediate
• Cloud Service Customer (CSC)Party that has a business relationship with a cloud provider to use its cloud services.Foundational
• Cloud Service Provider (CSP)Organization that offers cloud computing services such as IaaS, PaaS or SaaS to customers.Foundational
• Cloud Workload Protection Platform (CWPP)Security solution protecting workloads such as VMs, containers and serverless functions across hybrid and multicloud environments.Intermediate
• Cloud-Native Application Protection Platform (CNAPP)Unified platform combining CSPM, CWPP, CIEM and code-to-cloud security to protect cloud-native applications across their lifecycle.Advanced
• Community CloudDeployment model where infrastructure is shared by several organizations with common concerns such as mission or compliance.Foundational
• Complementary User Entity Controls (CUEC)Controls a service organization assumes its customers will implement for the overall control objectives to be met.Intermediate
• Confidential ComputingProtection of data in use by performing computation in hardware-based, attested trusted execution environments.Advanced
• Consensus Assessments Initiative Questionnaire (CAIQ)CSA questionnaire of yes/no questions based on the Cloud Controls Matrix for assessing cloud providers.Intermediate
• Container EscapeBreaking out of a container's isolation to gain access to the host or other containers.Advanced
• Continuous MonitoringMaintaining ongoing awareness of security, vulnerabilities, and threats to support risk decisions.Intermediate
• Control InheritanceSituation where a system receives protection from controls implemented by another entity or system.Intermediate
• Cross-Border Data TransferTransfer of personal data to a country outside the jurisdiction whose law protects it, such as from the EU to a third country.Intermediate
• Crypto-ShreddingRendering encrypted data unrecoverable by securely destroying the encryption keys.Intermediate
• CSA STARCloud Security Alliance Security, Trust, Assurance and Risk program and public registry for cloud provider assurance.Intermediate
• Customer-Managed Key (CMK)Encryption key created and controlled by the customer in a cloud key management service, rather than by the provider.Intermediate
• Data at RestData stored on persistent media such as disks, databases, backups, or cloud object storage.Foundational
• Data in TransitData moving across a network between systems, also called data in motion.Foundational
• Data in UseData actively being processed in memory or by a CPU, which is typically unencrypted during computation.Intermediate
• Data MaskingObscuring parts of sensitive data so it remains usable for some purposes without revealing the full value.Foundational
• Data ResidencyRequirement or choice that data be stored and processed in a specific geographic location.Foundational
• Data Security Posture Management (DSPM)Tools that discover, classify and monitor sensitive data across cloud data stores and assess its exposure and access risk.Advanced
• Data SovereigntyPrinciple that data is subject to the laws and governance of the country in which it is collected or stored.Foundational
• Disaster Recovery (DR)Policies, tools and procedures for restoring IT systems and data after a disruptive event such as a regional outage or ransomware.Foundational
• Disaster Recovery as a Service (DRaaS)Cloud service that replicates servers and data to a provider and orchestrates failover so workloads can recover after a disaster.Intermediate
• DoD Cloud Computing Security Requirements Guide (CC SRG)DoD guide defining security requirements and impact levels (IL2, IL4, IL5, IL6) for cloud services.Advanced
• Envelope EncryptionEncrypting data with a data key and then encrypting that data key with a separate master key (key encryption key).Advanced
• Federal Information Processing Standard 140-3 (FIPS 140-3)US/Canadian standard for validating cryptographic modules at four increasing security levels.Advanced
• Federal Risk and Authorization Management Program (FedRAMP)U.S. government program that standardizes security assessment and authorization of cloud products used by federal agencies.Intermediate
• FedRAMPFederal Risk and Authorization Management Program, the US government-wide approach to security assessment and authorization of cloud services.Intermediate
• FedRAMP 20xFedRAMP modernization initiative announced in 2025 to automate and accelerate cloud authorizations using key security indicators.Advanced
• FedRAMP Impact LevelsFedRAMP security baselines (LI-SaaS, Low, Moderate, High) aligned to FIPS 199 impact categorization.Advanced
• Google Cloud Key Management Service (Cloud KMS)Google Cloud service for managing cryptographic keys, with software, HSM, and external key options.Intermediate
• Government Cloud (GovCloud)Isolated cloud regions built for government agencies and contractors with stringent compliance such as FedRAMP High and ITAR.Intermediate
• GovRAMPNonprofit program (formerly StateRAMP) providing cloud security verification for US state and local governments.Advanced
• Hold Your Own Key (HYOK)Model where encryption keys remain in customer-controlled systems outside the cloud provider at all times.Advanced
• Homomorphic EncryptionEncryption that allows computation on ciphertext, producing encrypted results that decrypt to the correct answer.Advanced
• Hybrid CloudDeployment model combining two or more distinct clouds, typically private and public, connected to allow data and app portability.Foundational
• Information Rights Management (IRM)Technology that applies persistent usage restrictions to documents and emails wherever they travel.Intermediate
• Infrastructure as a Service (IaaS)Cloud service model providing virtualized compute, storage and networking; the customer manages the OS, runtime, apps and data.Foundational
• InteroperabilityAbility of cloud services, systems and components from different providers to exchange and use information.Intermediate
• ISO/IEC 27001International standard specifying requirements for establishing, implementing, maintaining, and improving an information security management system.Foundational
• ISO/IEC 27002Code of practice providing guidance on implementing information security controls.Intermediate
• ISO/IEC 27017Code of practice for information security controls for cloud services, for both providers and customers.Intermediate
• ISO/IEC 27018Code of practice for protecting PII in public clouds acting as PII processors.Intermediate
• Key Encryption Key (KEK)A key used to encrypt (wrap) other keys rather than data.Intermediate
• Key Management Service (KMS)Managed cloud service for creating, storing, controlling, and auditing cryptographic keys.Intermediate
• Measured ServiceNIST cloud characteristic: resource usage is metered, monitored and reported, enabling pay-per-use billing and transparency.Foundational
• MulticloudStrategy of using services from two or more public cloud providers within one organization or architecture.Foundational
• MultitenancyArchitecture where multiple customers (tenants) share the same physical infrastructure or application instance with logical isolation.Foundational
• NIST Definition of Cloud Computing (NIST SP 800-145)The NIST special publication that defines cloud computing via 5 essential characteristics, 3 service models and 4 deployment models.Foundational
• NIST SP 800-53NIST catalog of security and privacy controls for information systems and organizations.Intermediate
• On-Demand Self-ServiceNIST cloud characteristic: consumers provision compute, storage or network resources automatically without human interaction with the provider.Foundational
• Payment Card Industry Data Security Standard (PCI DSS)Industry standard with 12 requirements for protecting payment account data, maintained by the PCI Security Standards Council.Foundational
• Platform as a Service (PaaS)Cloud service model where the provider manages infrastructure and runtime; the customer deploys and manages applications and data.Foundational
• Private CloudDeployment model where cloud infrastructure is provisioned for exclusive use by a single organization, on or off premises.Foundational
• PseudonymizationProcessing personal data so it cannot be attributed to an individual without separately kept additional information.Intermediate
• Public CloudDeployment model where infrastructure is owned by a provider and shared among the general public on a pay-per-use basis.Foundational
• Rapid ElasticityNIST cloud characteristic: capabilities can be provisioned and released quickly, often automatically, to scale with demand.Foundational
• Recovery Point Objective (RPO)Maximum acceptable amount of data loss measured in time before a disruption.Foundational
• Recovery Time Objective (RTO)Maximum acceptable time to restore a service after a disruption.Foundational
• Resource PoolingNIST cloud characteristic: provider resources are pooled to serve multiple consumers in a multi-tenant model with location independence.Foundational
• Right to Audit ClauseContract provision allowing a customer or regulator to audit a vendor's controls, records, and facilities.Intermediate
• S3 Object LockS3 feature providing write-once-read-many (WORM) protection with retention periods and legal holds.Intermediate
• Secrets ManagementSecurely storing, distributing, rotating, and auditing credentials such as passwords, API keys, and certificates.Foundational
• Secure Access Service Edge (SASE)Cloud-delivered architecture converging SD-WAN networking with security services such as SWG, CASB, ZTNA and FWaaS.Intermediate
• Security as a Service (SECaaS)Delivery of security capabilities, such as email filtering, web gateways or SIEM, as cloud-hosted subscription services.Intermediate
• Service Level Agreement (SLA)Contractual commitment from a provider defining service availability or performance targets and remedies if they are missed.Foundational
• Shared Responsibility ModelFramework dividing security and operational duties between the cloud provider (of the cloud) and customer (in the cloud).Foundational
• ShowbackReporting cloud costs to the teams or business units that incurred them without actually billing them.Foundational
• SOC 2Report on a service organization's controls relevant to security, availability, processing integrity, confidentiality, or privacy.Foundational
• SOC 3General-use summary report of a SOC 2 examination suitable for public distribution.Intermediate
• SOC Type 2 ReportSOC report covering both design and operating effectiveness of controls over a specified period.Foundational
• Software as a Service (SaaS)Cloud service model delivering complete applications over the internet; the provider manages everything except user data and access.Foundational
• Sovereign CloudCloud offering designed so data, operations and control remain within a specific jurisdiction to satisfy sovereignty laws.Intermediate
• Standard Contractual Clauses (SCC)European Commission-approved contract clauses providing safeguards for transfers of personal data outside the EU.Intermediate
• System and Organization Controls Report (SOC report)AICPA attestation report by a CPA on controls at a service organization.Foundational
• Tenant IsolationControls that keep one cloud customer's compute, network and data separate and inaccessible to other tenants.Advanced
• Third-Party Assessment Organization (3PAO)Independent organization accredited by A2LA to perform FedRAMP security assessments.Intermediate
• TokenizationReplacing sensitive data with a non-sensitive surrogate value (token) that maps back to the original via a secure vault.Intermediate
• Transparent Data Encryption (TDE)Database feature that encrypts data and log files at rest without requiring application changes.Intermediate
• Trust Services Criteria (TSC)AICPA criteria for security, availability, processing integrity, confidentiality, and privacy used in SOC 2 and SOC 3.Intermediate
• Vendor Lock-InDependence on a provider's proprietary services or formats that makes switching providers costly or difficult.Foundational