Module 13: Cloud Data Concepts and Data Lifecycle

CCSP Domain 2 — Cloud Data Security Section A 6 min read

Domain 2 carries 20% of the CCSP exam — the highest weight. When data questions appear, the exam is testing whether you understand who owns the data, who controls it, and what obligations each role carries throughout the data lifecycle.

Data Roles in the Cloud

Before diving into the lifecycle, you must understand the data roles that the exam relies on throughout Domain 2. These roles determine accountability at every lifecycle phase.

Data Owner

The business role accountable for deciding how a dataset is classified, who should have access, and how it may be used. In many cloud scenarios that role sits with the customer, but legal ownership and regulatory roles depend on the data, parties, and agreement. Moving data to a provider does not by itself remove the customer's governance duties.

Data Custodian

The role that implements and operates protections specified by the owner. A provider may perform some custodial work, such as operating storage and physical safeguards, while the customer operates other controls, such as tenant access and data classification. The service model and contract determine the split.

Data Controller

Under GDPR, the controller determines the purposes and means of processing personal data. A cloud customer is often the controller and a provider often acts as its processor, but either party can be a controller for processing it determines independently. The actual activity, not the product label, decides the role.

Data Processor

Processes data on behalf of the controller. The CSP is typically the data processor. Processors must follow controller instructions and may face direct regulatory obligations under GDPR.

Exam trap: Do not confuse data custodian with data processor. The custodian is a security role focused on implementing controls. The processor is a legal/regulatory role focused on data handling instructions. A CSP may be both, but the exam may test them separately.

The Data Lifecycle in Cloud Context

You saw the CSA data lifecycle in Module 11. Here in Domain 2, we go deeper into each phase with a data security focus:

Create

Classification and labeling should occur at creation. In cloud environments, automated classification tools can tag data as it enters the system. The exam expects you to know that delaying classification creates a window where data may be mishandled.

Store

Cloud storage introduces new considerations: geographic distribution, replication across availability zones, and shared storage infrastructure. The exam tests whether you account for all copies of data, not just the primary store.

Use

Data in use is most vulnerable because it is typically in plaintext. Controls include DLP monitoring, access logging, and ensuring non-production environments use masked or synthetic data.

Cloud makes sharing easy — too easy. The exam tests scenarios where overly permissive sharing (public URLs, open APIs, misconfigured permissions) leads to data exposure.

Destroy

Crypto-shredding is the primary cloud data destruction method. Physical destruction is not possible when you do not own the hardware.

Data Dispersion in the Cloud

Cloud providers distribute data across multiple locations for availability and performance. This dispersion creates challenges: jurisdictional compliance, increased attack surface, and complexity in data destruction. The exam tests whether you understand that a single file in the cloud may exist in multiple physical locations simultaneously.

What to Remember

Data ownership stays with the customer. The CSP acts as custodian and processor but does not acquire ownership. Classification must happen at creation. Data dispersion means accounting for all copies. Crypto-shredding handles destruction across distributed storage. Every lifecycle phase requires controls matched to the data's classification level.