Cloud Security Operations · Topic 4 of 6
Operational Controls and Service Management
CCSP operational standards: NIST, ISO, HIPAA, COBIT, CIS, COSO, ITIL and ISO/IEC 20000-1, plus change, release, incident, problem and capacity management.
- 5 min
- ITIL is guidance; ISO/IEC 20000-1 is a certifiable service management standard.
- COBIT and COSO govern; CIS Controls and SP 800-53 list controls.
- Incident restores service; problem removes root cause.
What it is
Cloud operations run on repeatable processes. Operational standards and frameworks say what good practice looks like, and service management processes, mostly drawn from ITIL and ISO/IEC 20000-1, describe how changes, incidents, releases and capacity are handled day to day.
The exam expects you to know what each framework is for and which process owns a given situation.
How it works
Frameworks and standards
| Framework | Focus |
|---|---|
| NIST | US guidance: SP 800-53 Rev 5 controls, the Cybersecurity Framework 2.0, SP 800-145 cloud definition |
| ISO | ISO/IEC 27001 ISMS, 27002 controls guidance, 27017 cloud controls, 27018 PII in public cloud |
| HIPAA | US law protecting health information; Security Rule safeguards for electronic PHI |
| COBIT | ISACA framework for governance and management of enterprise IT |
| CIS Controls | Prioritized set of 18 top level controls broken into safeguards, with Implementation Groups for different maturity levels |
| COSO | Internal control framework with five components: control environment, risk assessment, control activities, information and communication, monitoring activities |
| ITIL | Best practice guidance for IT service management |
| ISO/IEC 20000-1 | Certifiable requirements for a service management system |
ITIL is guidance; ISO/IEC 20000-1 is a standard an organization can be certified against. COBIT and COSO sit at governance level; CIS Controls and NIST SP 800-53 are control catalogues.
Service management processes
| Process | Purpose |
|---|---|
| Change management | Assess, approve and schedule changes to reduce risk; a change advisory board reviews significant changes; emergency changes follow a fast but recorded path |
| Continuity management | Keep services able to recover within agreed targets after a disaster |
| Information security management | Protect the confidentiality, integrity and availability of information through policy and controls |
| Continual service improvement | Measure services and processes and improve them over time |
| Incident management | Restore normal service as quickly as possible after an unplanned interruption |
| Problem management | Find and remove the root cause of one or more incidents; record known errors and workarounds |
| Release management | Plan and package new or changed services and features for availability |
| Deployment management | Move new or changed components into live environments |
| Configuration management | Keep accurate records of configuration items and their relationships in a CMDB |
| Service level management | Agree, monitor and report service levels against targets in SLAs |
| Availability management | Ensure services meet agreed availability |
| Capacity management | Ensure enough capacity and performance for current and future demand, at acceptable cost |
Incident versus problem
Incident management asks "how do we get service back now?" and may use a workaround. Problem management asks "why did this happen, and how do we stop it recurring?" Many repeated incidents with the same cause should become one problem record.
Change, release, deployment and configuration
These four work together:
- A change request is raised and assessed for risk and impact.
- Change management approves it and schedules it.
- Release management packages the change.
- Deployment management puts it into production, ideally through an automated pipeline.
- Configuration management updates the CMDB so records match reality.
In the cloud, infrastructure as code and pipelines can implement much of this automatically. Standard, low risk changes can be pre-approved, while the pipeline still logs every one.
Security's role in each process
- Security reviews significant changes and has a voice on the change advisory board.
- Security incidents follow incident management, with extra steps for evidence and notification.
- Configuration management supplies the asset inventory for vulnerability management.
- Capacity and availability management protect against denial of service and cost spikes.
- Continual improvement uses lessons learned from incidents and audits.
A worked example
A cloud team suffers three outages in a month, each fixed by restarting a message queue service. Engineers also changed firewall rules directly in production during one outage, and the CMDB no longer matches the live configuration.
The incidents are linked to one problem record, and root cause analysis finds a memory leak fixed by a new release. The direct firewall change is recorded retrospectively as an emergency change, reviewed by the change advisory board, and the CMDB is reconciled. Future rule changes go only through the infrastructure as code pipeline.
How the exam asks about this
- "Which process aims to identify and eliminate the root cause of recurring incidents?" Problem management.
- "Which framework provides certifiable requirements for an IT service management system?" ISO/IEC 20000-1.
- "Which COSO component covers policies and procedures that carry out management directives?" Control activities.
What to remember for the exam
- ITIL is guidance; ISO/IEC 20000-1 is a certifiable service management standard.
- COBIT and COSO govern; CIS Controls and SP 800-53 list controls.
- Incident restores service; problem removes root cause.
- Change approves, release packages, deployment installs, configuration records.
- Service level management agrees and reports on SLAs; capacity and availability management keep them achievable.
Emergency changes are still changes. Skipping documentation and review in a crisis leaves untracked configurations that cause the next incident.
Common mistakes
Confusing incident and problem management. A workaround that restores service is incident management; finding why it broke is problem management.
Treating ITIL as a certification standard. Organizations certify against ISO/IEC 20000-1, not ITIL.
Letting the CMDB drift. If records do not match reality, change impact analysis and vulnerability management both fail.
Check yourself
What is the difference between release management and deployment management?
Release management plans and packages new or changed features, while deployment management moves those components into the live environment.
What are the five COSO components?
Control environment, risk assessment, control activities, information and communication, and monitoring activities.
Which process keeps records of configuration items and their relationships?
Configuration management, using a configuration management database.
Topic 4 of 6 in Cloud Security Operations
Test yourself on Cloud Security Operations
The full ISC2 CCSP question bank has 900 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.