Welcome. When an organisation moves mail, documents or a management system to the cloud, part of the security work really does pass to the provider: the data centres, the hardware, the physical network, often the operating system and the application itself. Another part never passes: who can get in, with which permissions, with which settings, where the data ends up, who holds the keys, who looks at the logs.

This is the distinction the large providers call shared responsibility, and the most useful summary is this: the provider is responsible for security of the cloud, the customer for security in the cloud. The documented incidents of recent years almost all originate in the second half: a role with too many permissions, an account without a second factor, storage left public, a log that nobody had enabled. No contract transfers that half.

The path holds together the two sides of the problem. The technical one, that is identity, configuration, data, keys, logs and incident response. And the one played out before and around the technology: the choice of provider, the contract, the obligations of NIS2 and the Italian decree, of the GDPR, of the Data Act and, for the financial sector, of DORA, and the exit strategy without which a cloud service becomes a dependency.

The exercises follow a single case: Corriere Brivio, a postal and courier services operator that is a NIS important entity, moving mail, documents, its shipping management system and part of its infrastructure to the cloud. A constructed case, with the real problems of anyone doing it today.

Path objectives

At the end of the path you will be able to:

• distinguish for IaaS, PaaS and SaaS what remains with the customer and place your organisation and your providers within the obligations of NIS2, GDPR, Data Act and DORA (Module 1);
• design identity and access in the cloud with phishing-resistant authentication, least privilege, emergency access accounts and governance of application identities (Module 2);
• keep configuration under control with reference configurations, continuous posture management, guardrails and verified infrastructure as code (Module 3);
• protect data with classification, encryption, key management and resilient backups, and assess technical choices also in the light of the rules on transfers (Module 4);
• enable and retain the logs you need, detect abuse and respond to a cloud incident within the notification deadlines (Module 5);
• choose and contract a provider, assess its certifications, govern concentration risk and prepare a workable exit strategy (Module 6).

Who it is for and prerequisites

The path is aimed at those who design, manage or purchase cloud services: IT and security managers, system and platform administrators, DevOps and architects, procurement and compliance managers, NIS contacts and DPOs.

Prerequisites. A basic familiarity with networks, systems and risk concepts, which Information Security Fundamentals provides. You do not need to know any particular provider: the path uses common concepts and cites the documentation of the main providers as examples. Those who develop software for the cloud will find the application side in Secure Software Development; incident management in general in Incident Management and Response; suppliers in the NIS programme in Module 13 of Cybersecurity Governance, Risk & Compliance.

How it works

The path is delivered entirely online, in asynchronous mode: you can study whenever you want, at your own pace, from any device. The estimated total duration is 26 hours, to be spread out within the completion deadline indicated below.

Each module is organised into four lessons and two checks:

1. Lesson. A reasoned treatment of the topic, with diagrams, examples and concrete cases.
2. Test. Closed-answer questions on the whole module. Passing requires at least 70%; attempts are unlimited and the best mark counts. At the end of each attempt you receive a detailed explanation of every answer, including the correct ones.
3. Exercise. A case to work through by making choices: each decision opens a different path and the outcome depends on what you chose, with an explanation of what would have happened otherwise. Assessment is automatic and you can retake it as many times as you like.

Progression. The 6 modules are taken in sequence: each module unlocks only after you have passed the test of the previous module. The exercises do not block progress, but they are an integral part of the path and of the overall assessment.

Final test and certificate

Once you have passed the tests of all modules, the final test unlocks: 30 questions drawn at random from the topics of the whole path, with the same 70% threshold. There are three attempts, at least one week apart from each other: if none reaches the threshold, the path restarts from the first module. When you pass, you obtain the path certificate, downloadable as a PDF, with a unique code that allows its authenticity to be verified.

Caveat

The content is up to date as of October 2026. Three specific caveats.

The first, about providers. Providers' services, trade names and default settings change often: the path teaches the concepts and cites the official documentation with the date it was read. Before applying a recommendation, check the current version of your own provider's documentation.

The second, on the law. The legislation cited has been read in the official texts, but the path does not constitute legal advice; for data transfers and contracts the decision rests with whoever is accountable for them, with the support of those who practise that law.

The third, on the cases. The real-world cases are verified against official sources (authorities, boards of inquiry, provider reports) and linked; the exercise scenarios are constructed.

Support

In the Announcements forum you will find the teacher's communications. For questions about the content or the exercises, use the channels indicated by your training contact.