Overview
Domain 1 builds the mental model the CCSP exam assumes everywhere else. It covers cloud computing concepts such as roles, essential characteristics and building-block technologies. It covers the reference architecture: service capabilities, categories, deployment models and shared considerations like portability and reversibility. It then covers security concepts as they change in the cloud, secure design principles including BC/DR and DevOps security, how to evaluate a cloud service provider (CSP), and, new in the 2026 outline, the security role of AI and machine learning.
The domain exists because almost every cloud security decision depends on knowing who controls what. The service model sets the split of responsibility. The deployment model sets who shares the infrastructure. The design principles decide whether security is built in or bolted on. Domains 2 to 6 apply this framework to data, infrastructure, applications, operations and law.
How it's tested
Expect BEST and MOST appropriate questions set in an organization moving to, or already running in, the cloud. Many hinge on responsibility under a given service model, or on choosing the design property that meets a stated business requirement. As a CISSP-style adaptive exam, CCSP favors the manager's view: understand the requirement, then choose the control.
-
Whose responsibility?
A service model and a security task are given, and you must decide whether the customer, the provider or both carry it.
-
Name the property
A requirement such as moving workloads to another provider or getting data back at exit must be matched to the right term: portability, interoperability or reversibility.
-
Cloud-feasible control
An on-premises-style control is offered alongside a cloud-native one, and you must pick the control the customer can actually implement.
A company on a public SaaS platform must make sure deleted customer records cannot be recovered. Physical drive destruction is out, because the customer does not control the media. Overwriting is unreliable on shared, distributed storage. The workable answer is cryptographic erase: encrypt the data with keys the customer controls, then destroy the keys. The question tests whether you think about what the customer can actually do in that service model.
Subdomains 6
Official subdomains from the ISC2 outline, in outline order.
1.1 Understand cloud computing conceptsDefinitions, roles, essential characteristics and building-block technologies.
- What it means
- This covers what makes a service cloud: on-demand self-service, broad network access, multi-tenancy, rapid elasticity and scalability, resource pooling, and measured service. It also covers the roles involved, such as cloud service customer, CSP, cloud service partner, cloud service broker and regulator, and the technologies underneath, such as virtualization, storage, networking, databases and orchestration.
- What to understand
- Each characteristic creates a security implication. Resource pooling and multi-tenancy mean isolation matters. Self-service means misconfiguration risk sits with the customer. Measured service means billing data can reveal unusual activity. Roles matter because accountability follows them.
- How it shows up
- A scenario describes a provider feature or an intermediary, and you must identify the characteristic or role, for example a broker that aggregates several providers.
- Common confusion
- Treating any hosted or virtualized system as cloud. Without self-service, elasticity and measured service it is outsourced hosting, with different risks.
1.2 Describe cloud reference architectureCapabilities, service categories, deployment models and shared considerations.
- What it means
- The reference architecture describes cloud activities, the capability types (application, platform, infrastructure), the service categories (SaaS, PaaS, IaaS), the deployment models (public, private, hybrid, community, multi-cloud), and cross-cutting considerations such as interoperability, portability, reversibility, auditability and service levels. It also covers the impact of related technologies such as AI, containers, edge computing and confidential computing.
- What to understand
- The service category and deployment model together decide how much control and visibility the customer has. Portability is the ability to move a workload or data to another environment, interoperability is the ability of components to work together, and reversibility is getting your data back and removing it from the provider when the relationship ends.
- How it shows up
- A business requirement is stated, such as avoiding lock-in or retrieving data at contract end, and you must choose the matching consideration or deployment model.
- Common confusion
- Calling a mix of on-premises and public cloud multi-cloud. That is hybrid. Multi-cloud means using more than one cloud provider.
1.3 Understand security concepts relevant to cloud computingCryptography, access, sanitization, network, virtualization security and hygiene in the cloud.
- What it means
- This applies familiar security concepts to cloud conditions: key management, identity and access for users, privileged accounts and services, media sanitization by overwriting or cryptographic erase, network controls such as security groups and geofencing, virtualization and container isolation, serverless and ephemeral computing, common cloud threats, and hygiene such as patching, baselining, hardening and immutable architecture.
- What to understand
- Physical control is usually gone, so logical controls carry the weight. Cryptographic erase is the practical sanitization method when the customer cannot touch the media. Key management determines who can really read the data. Immutable architecture replaces systems rather than patching them in place.
- How it shows up
- Questions ask how to sanitize data in a public cloud, how to secure service-to-service access, or what the main risk of a hypervisor compromise is.
- Common confusion
- Assuming encryption alone protects data from the provider. If the provider manages the keys, the provider can technically decrypt.
1.4 Understand design principles of secure cloud computingSecure data lifecycle, BC/DR, BIA, functional requirements, design patterns and DevOps security.
- What it means
- Design principles cover building security into cloud solutions from the start: protecting data through its life cycle, planning cloud-based continuity and recovery, using business impact analysis with cost-benefit analysis and ROI, setting functional requirements such as portability and avoiding vendor lock-in, applying responsibilities per service category, using patterns such as the Well-Architected Framework and CSA Enterprise Architecture, and securing DevOps pipelines.
- What to understand
- Business requirements drive design. The BIA tells you what must be protected and how fast it must recover, and cost-benefit analysis tells you what is worth spending. Design patterns and secure-by-design principles reduce the chance of security being an afterthought.
- How it shows up
- A design choice is presented, such as multi-region deployment or a single provider with no exit plan, and you must identify the risk or the principle it serves.
- Common confusion
- Treating vendor lock-in as purely a commercial issue. It is also a security and continuity risk if you cannot leave a failing or non-compliant provider.
1.5 Evaluate Cloud Service Providers (CSP)Verifying providers against criteria and recognizing product certifications.
- What it means
- Evaluation means checking a provider against defined criteria such as ISO/IEC 27001 certification, SOC 2 reports, CSA STAR entries or government programs, and understanding product-level certifications such as Common Criteria and FIPS 140 validation of cryptographic modules.
- What to understand
- Every certification has a scope. A provider's ISO/IEC 27001 certificate covers the provider's management system for listed services, not your configuration or every service they sell. Common Criteria evaluates a product against a security target, and FIPS 140 validates cryptographic modules.
- How it shows up
- A provider presents a certificate or report, and you must decide what it does and does not assure, or which evidence BEST meets a stated requirement.
- Common confusion
- Reading a provider certification as covering the customer's workloads. The customer's responsibilities remain unverified by it.
1.6 Comprehend Artificial Intelligence (AI)/Machine Learning (ML)AI for threat detection and automation, data validation, ethics and regulation.
- What it means
- This covers how AI and ML are used in cloud security, for example threat detection and analysis and security orchestration, automation and response (SOAR). It also covers validating and verifying the data that feeds models, and the ethical and regulatory concerns AI raises.
- What to understand
- AI is only as trustworthy as its training and input data, so data source validation is a security control. Automation speeds response but needs governance and human oversight for high-impact actions. Regulation of AI is expanding and varies by jurisdiction.
- How it shows up
- Questions ask what MOST affects the reliability of an AI detection tool, or what should be in place before allowing automated responses.
- Common confusion
- Treating AI output as authoritative. Models can be wrong, biased or manipulated through poisoned data, so outputs need validation.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Essential characteristics
On-demand self-service, broad network access, multi-tenancy, rapid elasticity and scalability, resource pooling and measured service, as listed in the outline.
- Remember
- NIST SP 800-145 lists five. The outline follows ISO/IEC 17788 in adding multi-tenancy.
- Tested as
- Recognizing what makes a service cloud.
- Trap
- Treating any virtualized hosting as cloud.
-
Shared responsibility
Security duties are split between provider and customer, and the split moves with the service category.
- Remember
- In IaaS the customer secures more; in SaaS the provider does. The customer always keeps data, identity and access decisions.
- Tested as
- Assigning controls in almost every domain.
- Trap
- Assuming SaaS leaves the customer nothing to do.
-
Portability vs. interoperability vs. reversibility
Moving workloads or data to another environment; components working together; getting data back and removed at exit.
- Remember
- Reversibility includes verified deletion from the provider.
- Tested as
- Matching business requirements to properties.
- Trap
- Using portability and interoperability as synonyms.
-
Cryptographic erase
Making data unrecoverable by destroying the keys that encrypt it.
- Remember
- The practical sanitization method when the customer cannot access physical media.
- Tested as
- Data disposal scenarios in public cloud.
- Trap
- Choosing physical destruction or degaussing for provider-owned media.
-
Hybrid vs. multi-cloud
Hybrid combines different deployment models, often private and public. Multi-cloud uses services from more than one provider.
- Remember
- They can overlap, but they are different ideas.
- Tested as
- Deployment model questions.
- Trap
- Calling on-premises plus one public provider multi-cloud.
-
Cloud service broker
A partner that aggregates, integrates or customizes services from one or more providers for customers.
- Remember
- Brokers add a party to the trust chain and to contracts.
- Tested as
- Role identification.
- Trap
- Confusing a broker with a CASB, which is a security control.
-
Vendor lock-in
Dependence on one provider's proprietary services, formats or contracts that makes leaving costly or impractical.
- Remember
- It is a continuity and compliance risk as well as a cost one.
- Tested as
- Design and contract questions.
- Trap
- Treating it as only a procurement concern.
-
Common Criteria vs. FIPS 140
Common Criteria evaluates a product against a security target at an assurance level. FIPS 140 validates cryptographic modules.
- Remember
- The outline names FIPS 140-2. FIPS 140-3 has superseded it for new validations.
- Tested as
- Product certification questions.
- Trap
- Treating a Common Criteria rating as proof the product is secure in your deployment.
-
Immutable architecture
Servers and containers are replaced from a known-good image rather than modified in place.
- Remember
- It reduces configuration drift and makes rollback simple.
- Tested as
- Security hygiene questions.
- Trap
- Patching live instances when the design calls for redeployment.
-
SOAR
Security orchestration, automation and response platforms connect tools and run playbooks automatically.
- Remember
- Automation needs governance and tested playbooks, and high-impact actions need human approval.
- Tested as
- AI/ML and operations questions.
- Trap
- Letting automation take irreversible actions without oversight.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
IaaS vs. PaaS vs. SaaS customer responsibility
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| IaaS | The provider supplies compute, storage and network. The customer manages operating systems, applications and data | Most customer control and most customer responsibility | Expecting the provider to patch guest operating systems |
| PaaS | The provider manages the runtime platform. The customer manages applications, configuration and data | Responsibility shared at the application layer | Overlooking secure coding and platform configuration |
| SaaS | The provider runs the application. The customer manages users, access settings and data | Least customer control, but data and identity remain the customer's | Ignoring sharing settings and access governance |
Portability vs. interoperability vs. reversibility
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Portability | Moving data or workloads between environments with little rework | About movement | Assuming it guarantees the data is deleted from the old provider |
| Interoperability | Systems and services working together and exchanging data | About cooperation | Using it to describe migrating away |
| Reversibility | Retrieving data and having it removed from the provider when the service ends | About a clean exit | Forgetting verified deletion is part of it |
Public vs. private vs. community vs. hybrid vs. multi-cloud
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Public | Infrastructure shared by many unrelated customers | Highest scale, least customer control | Assuming shared means insecure by default |
| Private | Cloud used by a single organization, on or off premises | Most control and isolation | Assuming it must be on premises |
| Community | Shared by organizations with common concerns, such as a sector | Shared requirements and governance | Confusing it with public cloud |
| Hybrid | Two or more deployment models connected | Combines models | Calling it multi-cloud |
| Multi-cloud | Services from more than one cloud provider | Combines providers | Assuming it removes all concentration risk |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Provider handles it
- What candidates pick
- Rely on the SaaS provider to control who in your organization can access shared data.
- Why it looks right
- The provider runs the application and its security features.
- Why it's wrong
- Access decisions and data governance stay with the customer under every service model.
Clue to watch for The scenario involves user permissions, sharing settings or data exposure inside a SaaS tool.
-
Shred the drives
- What candidates pick
- Physically destroy or degauss media to sanitize public cloud data.
- Why it looks right
- It is the strongest sanitization method on premises.
- Why it's wrong
- The customer cannot access provider media, and storage is shared and distributed. Cryptographic erase is the workable method.
Clue to watch for The environment is public cloud or multi-tenant.
-
Certificate covers everything
- What candidates pick
- Accept a provider's ISO/IEC 27001 certificate as proof your deployment is secure.
- Why it looks right
- Certification is independent and recognized.
- Why it's wrong
- Its scope covers the provider's management system for listed services, not your configuration or responsibilities.
Clue to watch for The question asks what the certificate assures, or what else is needed.
-
Hybrid called multi-cloud
- What candidates pick
- Describe on-premises systems plus one public provider as multi-cloud.
- Why it looks right
- There are multiple environments.
- Why it's wrong
- Multi-cloud means multiple providers. Mixing deployment models is hybrid.
Clue to watch for Count the providers, not the environments.
-
Encryption solves provider access
- What candidates pick
- Encrypt data at rest with provider-managed keys to stop the provider reading it.
- Why it looks right
- Encryption is the standard confidentiality control.
- Why it's wrong
- If the provider manages the keys, it can decrypt. Customer-managed or customer-held keys are needed for that goal.
Clue to watch for The requirement is to protect data from the provider itself.
-
Lock-in is a price issue
- What candidates pick
- Leave lock-in to procurement because it is about cost.
- Why it looks right
- Lock-in is usually discussed in commercial terms.
- Why it's wrong
- Being unable to move off a failing or non-compliant provider is a continuity and compliance risk that design must address.
Clue to watch for The scenario mentions provider instability, regulatory change or proprietary formats.
Answer framework
For any Domain 1 cloud design scenario, work through these steps before choosing an answer.
- Identify the service category and deployment model, because they decide how much control the customer actually has.
- Assign each security task in the scenario to the customer, the provider or both, using the shared responsibility split for that model.
- Match the stated business requirement to the precise property involved, such as portability, interoperability, reversibility or resiliency.
- Check that the control you are considering is one the customer can implement in that model, preferring cloud-native options such as cryptographic erase.
- Confirm the scope of any certification or assurance, and choose answers that meet the business requirement rather than the most technical option.
Practice question
Want more like this? The CCSP practice test has questions for every domain.
Checklist
0 of 13
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Start with the shared responsibility model across IaaS, PaaS and SaaS, because it decides answers throughout the exam. Draw the stack and mark who owns each layer until you can do it from memory. Then learn the deployment models and the cloud roles, paying attention to the broker and partner roles that candidates often overlook.
Next, work through the security concepts in 1.3 with one question in mind: what changes when the customer has no physical access? That question explains cryptographic erase, the weight placed on key management and the focus on isolation.
Candidates commonly underestimate the shared considerations, such as portability, interoperability and reversibility, and the scope of provider certifications. Both produce precise distinctions the exam likes to test. Give the new AI/ML subdomain focused time as well, since it is newer and less covered by older study material.
Afterwards, move to Domain 2. Its data security controls only make sense once you can say who controls the data, the keys and the storage in each model.
FAQ
How much of the CCSP exam is Domain 1?
Cloud Concepts, Architecture and Design carries 17% under the outline effective 1 August 2026.
What changed in Domain 1 in the 2026 outline?
The outline adds a subdomain on artificial intelligence and machine learning, covering AI-based threat detection, data source validation, SOAR, ethics and regulation. ISC2 also states that AI security is integrated across all six domains.
Do I need to memorize the NIST cloud definition?
You need to recognize the essential characteristics and what each means for security. The outline lists multi-tenancy alongside the five NIST characteristics, so know all six as written in the outline.
What is the difference between portability and reversibility?
Portability is the ability to move data or workloads to another environment. Reversibility is retrieving your data and having it removed from the provider when the relationship ends.
Why does cryptographic erase come up so often?
In public cloud the customer cannot reach the physical media, so destroying the encryption keys is the realistic way to make data unrecoverable.
Is Domain 1 mostly theory?
It is conceptual, but questions are applied. You will be asked to choose controls and design options for specific scenarios, not to recite definitions.
How does Domain 1 connect to the other domains?
It supplies the responsibility model and design principles that the data, infrastructure, application, operations and legal domains all build on.
Other Cybersecurity certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
- CompTIA Cybersecurity Analyst+ Study guide
- Microsoft Security Operations Analyst Associate Study guide
- Certified Ethical Hacker Study guide
- Penetration Tester Study guide
- Systems Security Certified Practitioner Study guide
- Certified in Risk and Information Systems Control Study guide
- CompTIA PenTest+ Study guide
- CompTIA SecurityX (CASP+) Study guide
- Azure Security Engineer Associate Study guide
- CISM (Certified Information Security Manager) Study guide
- CISSP Study guide
- CompTIA Security+ Study guide
- Certified Information Systems Auditor Study guide
Test your Domain 1 knowledge
You have covered cloud roles, service and deployment models, shared responsibility and provider evaluation. Test whether you can assign responsibility and pick cloud-feasible controls under exam conditions.