The Certificate of Cloud Security Knowledge (CCSK) is the most accessible vendor-neutral cloud security credential, but its open book, online format leads many candidates to underestimate a timed exam with an 80% pass mark. This guide sets out what the Cloud Security Alliance (CSA) publishes about the current version, CCSK v5: who it is for, the exam format, the 12 domains, the body of knowledge, price, attempts and the fact that it does not expire. It adds a preparation plan, readiness measures, common mistakes and where the CCSK sits next to the CCSP and provider-specific certifications. It is written for security practitioners moving into cloud, cloud engineers who need the security vocabulary, and auditors and risk staff. Facts are as published on cloudsecurityalliance.org and the CSA exam site, checked October 2026; CSA can change exam details, so confirm before you buy a token.
Key takeaways
- CCSK v5 is the current version. CSA released it on 16 July 2024, consolidating the content into 12 domains from 14 and adding material on Zero Trust, DevSecOps and AI.
- The exam is 60 questions in 120 minutes. It is online, open book and cannot be paused, with a minimum passing score of 80%.
- There are no prerequisites. CSA requires no work experience or prior qualification, though it says a grounding in firewalls, secure development, encryption and IAM helps.
- A token costs $445 and includes two attempts. The token is valid for two years from purchase, and there is no enforced wait between attempts.
- It does not expire. There is no renewal fee or CPE requirement, but CSA advises staying current with the latest CCSK version.
Who the certification is for
CSA positions the CCSK as a certificate of knowledge across cloud security, based on its own Security Guidance. The v5 domains run from cloud concepts and governance through IAM, monitoring, workloads, data and application security to incident response, so the credential suits anyone who needs a provider-neutral map of the field rather than deep skills in one platform.
- Strong fit: security analysts and engineers moving into cloud work, cloud and DevOps engineers who need the security vocabulary, and architects who work across more than one provider. See the Cloud Security Engineer Career Guide.
- Strong fit: auditors, risk managers and procurement staff who assess cloud providers, since the governance, risk and compliance domains connect to CSA's Cloud Controls Matrix and STAR programme. See the Cloud Security Alliance CCM and STAR Guide.
- Weaker fit: engineers who need to prove hands-on skills on one platform, for whom the AWS Certified Security Specialty Guide or Google Professional Cloud Security Engineer Guide is the closer match, and senior staff who need an experience-gated credential such as the CCSP.
Exam format and domains
Format
| Item | CCSK v5 (as published by CSA, checked October 2026) |
|---|---|
| Version | CCSK v5, released 16 July 2024 |
| Questions | 60, drawn randomly from a larger question pool |
| Question types | Multiple choice and true/false (CSA roadmap article) |
| Time | 120 minutes; the exam cannot be paused or resumed later. One CSA page description shows 90 minutes, but the CCSK page body, exam FAQ and CSA roadmap all state 120, so check the exam platform before you start |
| Passing score | 80% minimum |
| Materials | Open book; CSA advises relying on study materials as little as possible because the exam is timed |
| Delivery | Online, through the CSA exam platform, started at a time you choose |
| Languages | English, Spanish and Japanese |
| Results | Immediate, with the number of questions per domain and how many you answered correctly in each; correct answers to individual questions are not shown |
CSA's roadmap article states an average passing rate of 62%. Treat that as CSA's own figure; it is a reminder that open book does not mean easy.
The 12 domains
The CCSK v5 domains match the 12 domains of the CSA Security Guidance v5, which CSA calls the foundational document on which CCSK v5 is based. CSA's roadmap article publishes the weights of the three largest domains; for the rest, use the CCSK Knowledge Guide in the free Prep Kit.
| Domain | Published weight | What to be able to explain |
|---|---|---|
| 1. Cloud Computing Concepts & Architectures | See Knowledge Guide | Service and deployment models, the shared responsibility model, reference architectures |
| 2. Cloud Governance | See Knowledge Guide | Governance hierarchy, policies, provider assessment |
| 3. Risk, Audit, & Compliance | See Knowledge Guide | Cloud risk management, audit evidence, compliance inheritance from the provider |
| 4. Organization Management | See Knowledge Guide | Account, subscription and project hierarchies, organisation-level guardrails |
| 5. Identity & Access Management | See Knowledge Guide | Federation, least privilege, human and workload identities, privileged access |
| 6. Security Monitoring | See Knowledge Guide | Cloud telemetry, control plane logs, posture management |
| 7. Infrastructure & Networking | 10% | Virtual networks, segmentation, Zero Trust and SASE concepts |
| 8. Cloud Workload Security | 11.67% | Virtual machines, containers, serverless and AI workloads |
| 9. Data Security | See Knowledge Guide | Classification, encryption and key management, storage security |
| 10. Application Security | 10% | Secure development lifecycle, DevSecOps, pipeline controls |
| 11. Incident Response & Resilience | See Knowledge Guide | Cloud incident response phases, forensics constraints, resilience design |
| 12. Related Technologies & Strategies | See Knowledge Guide | Zero Trust, generative AI and other emerging topics |
The "what to be able to explain" column is our practitioner summary of each domain's scope, not CSA text. Read the Security Guidance chapter for the authoritative content.
Prerequisites and experience
CSA states that no official work experience or prior qualification is required. It recommends basic knowledge of security fundamentals: firewalls, secure development, encryption and identity and access management. In practice, candidates without any cloud exposure find the questions abstract; a few weeks with a free tier account on any major provider makes the guidance far easier to absorb.
| Background | Typical gap | What to do first |
|---|---|---|
| Security generalist, no cloud | Service models, control plane, shared responsibility | Domains 1 and 4, plus a hands-on sandbox |
| Cloud engineer, little security | Governance, risk, compliance and incident response | Domains 2, 3 and 11 |
| Auditor or risk professional | Workload, network and application controls | Domains 7, 8 and 10, the three heaviest |
| Holder of a provider certification | Provider-neutral terms and CSA's framing | Read the Security Guidance end to end and note where CSA terms differ from your provider's |
Preparation plan
CSA offers several routes: self-study with the free Prep Kit, self-paced online training (English only), instructor-led training online or in person, CCSK Plus, which adds hands-on labs, and team training. A typical self-study plan is 4 to 8 weeks part-time; that is practitioner guidance, not a CSA figure.
- Week 1, set up: download the CCSK Prep Kit (Knowledge Guide, Study Guide, sample questions, acronym list and recommended readings) and the Security Guidance v5. Start with the Knowledge Guide, which CSA recommends as the starting point.
- Weeks 1 to 4, read the Guidance: one or two domains a session. Make your own index of key terms by domain and page as you go; it is the main tool for an open book exam.
- Weeks 2 to 5, connect to practice: for each domain, look at how one provider implements it, for example organisation hierarchies for Domain 4 or workload identity for Domain 5. See the Cloud Security Guide and Multi-Cloud Identity Guide.
- Week 5 onwards, test: do the CSA sample questions, then timed sets of 60 questions in 120 minutes. Track per-domain accuracy the way the CSA results page reports it.
- Decide on CCSK Plus: if you lack hands-on experience, the lab-based course closes the gap between reading and doing; experienced engineers can usually self-study.
- Sit the exam: pick an uninterrupted two-hour window, since it cannot be paused. If you fail, review the per-domain results before using the second attempt.
Measuring readiness
- Practice score: consistently above the 80% pass mark on timed practice, with margin, since the real pool is larger.
- Lookup rate: needing your notes for fewer than about one question in five; at 2 minutes a question there is little time to search.
- Domain spread: no domain far below the rest, especially the three heaviest.
- Explain-back: ability to explain the shared responsibility model for IaaS, PaaS and SaaS without notes.
Cost, renewal and continuing education
| Item | What CSA states (checked October 2026) |
|---|---|
| Exam token | $445 USD for the exam and CCSK chatbot bundle, effective 16 July 2024 |
| Attempts | Two per token; after two failed attempts you need a new token |
| Token validity | 2 years from purchase; CSA recommends sitting within one year |
| Waiting period | None enforced between attempts |
| Training | Optional; some training packages include a token |
| Expiry | The CCSK does not expire |
| Renewal or CPE | No formal renewal process; CSA advises staying current with the latest version |
| After passing | A digital badge; CSA states the CCSK can count toward continuing education credits for other IT credentials |
Because it never expires, the CCSK version matters on a CV. A v4 holder certified before July 2024 learned a 14-domain body of knowledge without CSA's current Zero Trust and AI material. Employers and candidates should state the version. CSA's pages read for this guide do not describe an upgrade path from v4, so check with CSA if that applies to you.
Where it fits on the career path
The CCSK is commonly an early or parallel step: a foundation before a provider-specific exam, or a vendor-neutral complement to one. CSA suggests follow-on credentials of its own: the Certificate of Competence in Zero Trust (CCZT), the Certificate of Cloud Auditing Knowledge (CCAK) and STAR Lead Auditor training.
| Credential | Scope | Typical position |
|---|---|---|
| CCSK | Vendor-neutral, knowledge-based, no prerequisites, no expiry | Foundation for cloud security roles of any kind |
| CCSP | Vendor-neutral, experience-gated, CPE-maintained | Senior and architect roles; see the CCSP Certification Guide |
| AWS Certified Security - Specialty | AWS services, scenario-based | Engineers on AWS |
| Google Professional Cloud Security Engineer | Google Cloud services | Engineers on Google Cloud |
| Microsoft security certifications | Azure and Microsoft security stack | Azure shops; see the Microsoft Security Certifications Guide |
Small and large organisations: smaller organisations often use the CCSK as a low-cost way to give a whole team common cloud security vocabulary. Larger organisations tend to pair it with provider-specific certifications for engineers and the CCSP for architects and leads.
Where the domains map to frameworks
| CCSK v5 domain | NIST CSF 2.0 categories |
|---|---|
| Cloud Governance; Risk, Audit, & Compliance | GV.PO Policy, GV.RM Risk Management Strategy, GV.SC Cybersecurity Supply Chain Risk Management, ID.RA Risk Assessment |
| Organization Management | GV.RR Roles, Responsibilities, and Authorities, ID.AM Asset Management |
| Identity & Access Management | PR.AA Identity Management, Authentication, and Access Control |
| Security Monitoring | DE.CM Continuous Monitoring, DE.AE Adverse Event Analysis |
| Infrastructure & Networking; Cloud Workload Security; Application Security | PR.PS Platform Security, PR.IR Technology Infrastructure Resilience |
| Data Security | PR.DS Data Security |
| Incident Response & Resilience | RS.MA Incident Management, RS.AN Incident Analysis, RC.RP Incident Recovery Plan Execution |
Where identity fits
Identity has its own CCSK domain, and it runs through workload security and data security as well. In cloud environments most identities are non-human: service accounts, roles, API keys and tokens. Incidents such as the Football Australia AWS keys exposure, where cloud keys embedded in website code opened storage buckets, show why the provider-neutral principles the CCSK teaches (least privilege, short-lived credentials, secrets kept out of code) matter on every platform. See the Cloud Workload Identity Guide.
Common failure patterns
- Treating open book as easy: 60 questions in 120 minutes leaves about two minutes each; candidates who look up every answer run out of time.
- Studying v4 material: older courses and question banks use the 14-domain structure and miss v5 topics such as Zero Trust, DevSecOps and AI.
- Answering from one provider: the exam tests CSA's provider-neutral framing; a correct answer on AWS may not be the answer the Guidance expects.
- Starting without a clear window: the exam cannot be paused, so interruptions cost time.
- Burning both attempts quickly: with no enforced wait, candidates retake immediately without studying the domains they failed.
- Letting the token lapse: tokens are valid for two years from purchase, and unused attempts are lost after that.
Practitioner checklist
- Confirm on the CSA site that the exam you are buying is CCSK v5 or later, and check the current price.
- Download the free Prep Kit and the Security Guidance v5 before paying for training.
- Build a personal index of terms by domain and page while reading.
- Pair each domain with a hands-on example on at least one cloud provider.
- Take the CSA sample questions, then timed sets of 60 questions in 120 minutes.
- Decide whether CCSK Plus labs are worth it based on your hands-on experience.
- Book a quiet two-hour window and sit within a year of buying the token.
- After a fail, review per-domain results before using the second attempt.
- Record the version on your CV and badge, and plan the next credential.
Standards and references
- Cloud Security Alliance: Certificate of Cloud Security Knowledge (CCSK)
- Cloud Security Alliance: CCSK Exam FAQ
- Cloud Security Alliance: Security Guidance for Critical Areas of Focus in Cloud Computing v5
- Cloud Security Alliance: Guide to the CCSK (Prep Kit)
- Cloud Security Alliance: Roadmap to Earning Your CCSK
- Cloud Security Alliance: CCSK v5 FAQ
- NIST: Cybersecurity Framework 2.0
Related NHI Mgmt Group resources: Cybersecurity Certifications Guide · Cloud Security Guide · CCSP Certification Guide · Cloud Security Alliance CCM and STAR Guide · AWS Certified Security Specialty Guide