Cloud Service Models, Deployment Models, and Shared Security

Service and Deployment Models

Subdomain 4.3, Understand cloud security, names service models and deployment models as topics. The outline does not list specific models, so study the concept of each model and how it allocates management to the provider and the customer.

Source: ISC2 CC Exam Outline effective September 1, 2026 (v01/2026), subdomain 4.3, https://www.isc2.org/certifications/cc/cc-certification-exam-outline, checked 2026-10-22.

The Shared Security Model

The outline names the shared security model, which describes roles and responsibilities. The provider is responsible for the cloud it runs; the customer remains responsible for its data, identities, and access decisions. A scenario that asks who owns a control should be answered by the role the model assigns, not by assuming the provider handles all security.

What the Outline Lists for This Section

The outline names these items. Be able to explain each one in plain language and apply it to a short scenario:

• 4.3: Characteristics (broad network access, rapid elasticity, measured service, on-demand self-service, resource pooling)
• 4.3: Service models
• 4.3: Deployment models
• 4.3: Shared security model (e.g., roles and responsibilities)

Common Traps

A common trap is assuming the provider owns all cloud security. Under the shared security model, the customer keeps responsibility for its data and access decisions.