CCSP - Cloud Security Operations (17% of the exam) - Section 5.3
Implement operational controls and standards.
Change, continuity, information security, continual service improvement, incident, problem, release, deployment, configuration, service level, availability and capacity management, framed by ITIL and ISO/IEC 20000-1.
A media company operates a hybrid-cloud video pipeline and wants to certify that its service management processes for incident, change and problem handling meet a recognised, auditable international standard that customers can rely on in contracts. Which standard should it pursue certification against?
AISO/IEC 20000-1, to certify a service management system covering those operational processescheck_circle Correct
BNIST SP 800-145, to formalise the definitions of its cloud service and deployment models
CISO/IEC 27018, to demonstrate protection of personally identifiable information in the public cloud
DISO/IEC 27017, to adopt the cloud-specific information security controls for the pipeline
Map service management certification of incident, change and problem processes to ISO/IEC 20000-1 rather than security or privacy standards. ISO/IEC 20000-1 is the specification for a service management system and is the standard organisations certify against for processes such as incident, change and problem management, whereas the ISO/IEC 27000-series and NIST documents cited address security, privacy or definitions instead.
Why A is correct: ISO/IEC 20000-1 specifies requirements for a service management system, including incident, change and problem management, and organisations can be certified against it, matching the stated need.
Why B is wrong: NIST SP 800-145 defines the essential characteristics, service models and deployment models of cloud computing; it is a definitional document, not a certifiable service management standard.
Why C is wrong: ISO/IEC 27018 gives a code of practice for protecting PII processed in public clouds; it addresses privacy controls rather than the management system for incident, change and problem processes.
Why D is wrong: ISO/IEC 27017 provides cloud-specific security control guidance and is tempting for a cloud pipeline, but it targets information security controls, not certification of the service management processes named in the scenario.
Answers that look right on this material and are not. Each one is a distractor from a different question in the CCSP bank for this domain.
ISO/IEC 27017, the code of practice for information security controls for cloud services
errorWhy it is wrong: ISO/IEC 27017 is tempting because it is cloud-specific, but it addresses information security controls, not service management system requirements.
Incident management, by keeping a standing incident open until the export function stops failing
errorWhy it is wrong: Incident management restores service quickly for each occurrence, which is why it keeps closing and reopening; it is not designed to hold an incident open to hunt the underlying cause.
To perform the root-cause analysis that explains why the authentication service required patching in the first place
errorWhy it is wrong: Root-cause analysis is problem management; the board consumes such findings but its own duty is authorisation, not investigation.