Zero trust is in almost every security strategy, yet few people on a programme can show they share a common vocabulary for it, which is the gap the Cloud Security Alliance's Certificate of Competence in Zero Trust (CCZT) sets out to fill. This guide covers what CSA publishes about the CCZT: who it suits, the exam format, the seven topic areas, prerequisites, the free prep kit, price and attempts. It adds a preparation plan that ties each topic to the NIST and CISA material behind it, and shows where the certificate sits next to the CCSK and deeper architecture credentials. It is written for security architects, engineers, identity practitioners and programme managers working on zero trust, and for managers who fund their training. Facts are as published on CSA's CCZT page, checked on 27 October 2026; check current fees and terms with CSA before you buy.
Key takeaways
- It is a knowledge certificate, not a practitioner certification. CSA calls it a certificate of competence: an open-book online exam that tests understanding of zero trust concepts and planning, not a hands-on build.
- The exam is short and the bar is high. 60 multiple choice questions drawn at random from a larger pool, 120 minutes, and a pass mark of 80%.
- It is cheap to sit. CSA lists USD 175 per exam purchase, which includes two attempts to be used within two years, and a free prep kit for self-study.
- There are no formal prerequisites. CSA asks for no work experience or prior qualification but recommends a grounding in cloud security, and describes the CCSK as an excellent precursor.
- The topics follow NIST and CISA. The seven areas run from foundational concepts and architecture, through the software defined perimeter, to strategy, planning, implementation and NIST and CISA best practice.
Who the certification is for
Zero trust programmes cut across network, identity, endpoint, application and data teams. The CCZT is most useful as a shared baseline for those teams, rather than as a marker of deep expertise in any one of them.
| Profile | Fit | Why |
|---|---|---|
| Security and enterprise architects starting a zero trust programme | Good | Covers strategy, planning and the reference architectures the programme will be built on |
| Identity and access practitioners | Good | Identity is the policy anchor of most zero trust designs; the certificate puts IAM work into the wider architecture |
| Network engineers moving from perimeter to ZTNA or SDP | Good | The software defined perimeter is one of the seven topics |
| Programme and project managers, risk and audit staff | Good | No prerequisites and a conceptual exam; enough to judge plans and progress |
| Senior architects who have already delivered zero trust | Weaker | Likely to confirm what they know; a deeper architecture credential or published work will show more |
| People with no security background at all | Weaker | Passable with the prep kit, but CSA recommends a grounding in cloud security first |
If you are new to cloud security, start with the CCSK; see the CCSK Certification Guide. For the wider landscape of credentials, see the Cybersecurity Certifications Guide.
Exam format and domains
Format
| Item | What CSA publishes (checked 27 October 2026) |
|---|---|
| Delivery | Online |
| Book rules | Open book |
| Questions | 60 multiple choice, selected randomly from a larger pool |
| Time | 120 minutes |
| Pass mark | 80% |
| Attempts | Two attempts per exam purchase, to be used within two years |
| Language | English only, for both training and exam |
Two minutes per question looks generous, but an 80% pass mark on 60 questions means you can afford to get no more than 12 wrong. Open book helps only if you know where the answer is: candidates who search the prep kit for every question run out of time.
The seven topic areas
CSA lists seven topics in the CCZT body of knowledge. The second and third columns are our suggestions for what to study under each and where it shows up in practice; they are not part of CSA's outline.
| CSA topic | What to be able to explain | Related reading |
|---|---|---|
| Zero Trust Foundational Concepts | Why implicit trust based on network location fails; the principle of per-request, least privilege access decisions; the role of continuous verification | Zero Trust Identity Guide |
| Zero Trust Architecture | Logical components such as the policy engine, policy administrator and policy enforcement point, and the deployment models built from them | NIST SP 800-207 Zero Trust Architecture Guide |
| Software Defined Perimeter | How SDP hides services until a user and device are authenticated, and how it relates to ZTNA products | ZTNA Guide |
| NIST and CISA Best Practices | What the NIST architecture and the CISA maturity model each contribute, and how agencies and companies use them | CISA Zero Trust Maturity Model Guide |
| Zero Trust Strategy | Business drivers, sponsorship, scope, and how to measure progress through maturity | Zero Trust Maturity Model Guide |
| Zero Trust Planning | Choosing protect surfaces, mapping transaction flows, inventorying assets and identities, sequencing the work | NIST SP 1800-35 Implementing a Zero Trust Architecture Guide |
| Zero Trust Implementation | Building policies, phased rollout, monitoring and adjusting, cloud-native patterns | NIST SP 800-207A Zero Trust for Cloud-Native Applications Guide |
Where identity fits
Every access decision in a zero trust architecture starts with an identity, and in most estates the majority of those identities are not people: service accounts, workload identities, API keys and, increasingly, AI agents. The CCZT topics do not list non-human identity separately, so add it to your revision. For each architecture pattern you study, ask how a workload proves who it is, how its policy is expressed and what happens when its credential leaks. See the Zero Trust for AI Agents Guide.
Prerequisites and experience
- Formal requirement: none. CSA states that no work experience or prior qualification is required.
- Recommended: a basic grounding in cloud security. CSA describes the CCSK as an excellent precursor to CCZT training.
- Practical advice: working knowledge of identity federation, network segmentation and endpoint posture makes the architecture and implementation topics far easier. If you have never configured a conditional access policy or a ZTNA connector, spend an afternoon in a trial tenant before you start.
Preparation plan
CSA offers three routes: the free prep kit for self-study, self-paced online training, and instructor-led training online or in person. CSA's page does not list training prices; ask CSA or a training partner. The plan below assumes self-study over four to six weeks of part-time effort.
- Get the prep kit (week 0): download it from CSA and treat it as the syllabus, because the exam is built on CSA's own material.
- Read the foundations (week 1): foundational concepts and architecture first. You should be able to draw the policy engine, administrator and enforcement point from memory.
- Read the primary sources (week 2): NIST SP 800-207 and the CISA Zero Trust Maturity Model are named in the topic list. Read them directly, not only the summaries.
- Strategy, planning and implementation (weeks 3 to 4): work through these with a real or imagined organisation. Write a one-page plan: protect surfaces, first pilot, success measures.
- Build an index (week 5): because the exam is open book, prepare a short index of where each concept sits in the prep kit and primary sources. A good index is worth more than extra reading.
- Rehearse and sit (week 6): practise answering 60 questions in 120 minutes; look up only what you cannot answer in your first pass.
- Use the second attempt wisely: if you fail, note the weaker topics from your recall straight after the exam and revise those before the second attempt, within the two-year window.
Measuring readiness
- Recall without notes: you can explain each of the seven topics in two minutes.
- Practice score: at least 85% on practice questions, to clear the 80% pass mark with margin.
- Pace: first pass through 60 questions in about 80 minutes, leaving time to look up the rest.
- Applied understanding: you can explain how a given access request in your own organisation would be evaluated under a zero trust design.
Small vs large organisations: in a small organisation one person may hold the whole zero trust plan and benefits most from the strategy and planning topics. In a large organisation, putting several teams through the CCZT is a low-cost way to build a shared vocabulary before architecture decisions; CSA notes that corporate membership includes CCZT discounts and team training credits.
Cost, renewal and continuing education
| Item | What CSA publishes (checked 27 October 2026) |
|---|---|
| Exam purchase | USD 175 |
| Attempts included | Two |
| Time to use attempts | Two years from purchase |
| Prep kit | Free |
| Training | Self-paced or instructor-led; prices not listed on the CCZT page |
| Corporate discounts | Included in CSA corporate membership, with team training credits |
| Renewal, expiry or CPE | Not stated on the CCZT page; confirm with CSA |
Check current fees with CSA before you buy; prices and terms can change. If you hold credentials that require continuing education, such as ISC2 or ISACA certifications, CCZT study and the exam may count towards their CPE, under those bodies' own rules. See the Certification Renewal and CPE Requirements Guide.
Common failure patterns
- Relying on open book: looking up every answer leaves too little time; build an index and answer from memory first.
- Studying vendors instead of concepts: the exam is about architecture and planning, not any product's configuration screens.
- Skipping the primary sources: the NIST and CISA topic is named explicitly; read the documents themselves.
- Treating zero trust as a network project: candidates from network roles underweight identity and data, which run through every topic.
- Forgetting machine identities: in practice the hardest part of zero trust is applying it to service accounts and tokens. In the Cloudflare Thanksgiving breach, one service token and three service account credentials left unrotated after an earlier breach gave an attacker a way back in, despite strong controls on human access.
- Letting attempts lapse: the two attempts must be used within two years of purchase.
Where it fits on the career path
- Before: the CCSK for cloud security foundations; see the CCSK Certification Guide.
- Alongside: identity credentials, because identity is at the core of zero trust; see the Identity Certifications Guide.
- After: deeper cloud or architecture credentials, such as the CCSP; see the CCSP Certification Guide.
- Roles: security architect, identity architect, zero trust programme lead and network security engineer moving to ZTNA.
CSA does not publish pass rates or salary figures on the page checked for this guide, and we do not quote third-party estimates. Because the CCZT is low cost and quick, its value to an employer lies mainly in a common vocabulary across teams; pair it with delivery experience you can describe. For common programme mistakes, see Top 10 Zero Trust Mistakes.
Practitioner checklist
- Decide whether the CCZT fills a real gap for you or your team: shared vocabulary, programme planning or a move from perimeter networking.
- Check current fees and terms on CSA's CCZT page before buying.
- Download the free prep kit and use it as the syllabus.
- Read NIST SP 800-207 and the CISA Zero Trust Maturity Model directly.
- Write a one-page zero trust plan for a real or imagined organisation.
- Build an index of the prep kit for the open-book exam.
- Score at least 85% on practice questions within 120 minutes before you sit.
- Add service accounts, workload identities and AI agents to your revision of every architecture pattern.
Standards and references
- Cloud Security Alliance: Certificate of Competence in Zero Trust (CCZT)
- NIST: SP 800-207 Zero Trust Architecture
- CISA: Zero Trust Maturity Model
Related NHI Mgmt Group resources: Cybersecurity Certifications Guide · CCSK Certification Guide · NIST SP 800-207 Zero Trust Architecture Guide · Zero Trust Identity Guide