The CCSP exam changed twice in a year, moving to an adaptive format in October 2025 and to a new outline with AI content on 1 August 2026, so many candidates are revising for an exam that no longer exists. This guide sets out what ISC2 itself publishes about the Certified Cloud Security Professional: the current format, the six domains and their weightings, the five-year experience rule and the CCSK and CISSP substitutions, endorsement, fees and continuing education. It adds a phased preparation plan and shows how the CCSP compares with vendor cloud credentials. It is written for cloud, security and architecture practitioners deciding whether and when to sit the exam, and for managers who fund it. Facts are as published by ISC2 and checked on 24 October 2026; confirm on the linked ISC2 pages before you book.
Key takeaways
- It is a vendor-neutral cloud credential. ISC2 describes the CCSP as demonstrating advanced skills to design, manage and secure data, applications and infrastructure in the cloud, independent of any one provider.
- A new outline took effect on 1 August 2026. It keeps six domains, raises Cloud Data Security to the largest weight at 20%, and adds AI content to every domain.
- The exam is adaptive. Since 1 October 2025 the CCSP uses Computerized Adaptive Testing with 100 to 150 items in a maximum of three hours; the outline gives a passing grade of 700 out of 1000.
- The experience rule has useful shortcuts. ISC2 asks for five years of IT experience including three in cybersecurity and one in a CCSP domain, but an active CISSP substitutes for the whole requirement and the CCSK for one year.
- Renewal is 90 CPE in three years. Holders pay an AMF of USD 135 a year and earn 90 CPE credits per three-year cycle, with ISC2 suggesting 30 a year.
Who the certification is for
The CCSP is ANAB accredited against ISO/IEC 17024 and ISC2 lists it as approved by the US Department of Defense under DoDM 8140.03. Its experience rule (five years in IT) places it at the experienced practitioner level, alongside the CISSP rather than below it.
- Good fit: security engineers and architects who design or assure workloads across more than one cloud provider, cloud platform engineers who own security controls, and consultants and auditors who assess cloud services and contracts.
- Good fit for CISSP holders: an active CISSP satisfies the entire CCSP experience requirement, so the CCSP is a common way for CISSP holders to show cloud depth.
- Weaker fit: engineers working entirely in one provider, whose employers may value that provider's own security credential more. See the AWS Certified Security Specialty Guide, the Microsoft Security Certifications Guide and the Google Professional Cloud Security Engineer Guide.
- Not yet: people early in their careers. The CCSK is a common first cloud credential and counts for one year of CCSP experience; see the CCSK Certification Guide.
Exam format and domains
Format
| Item | What ISC2 publishes | Source |
|---|---|---|
| Format | Computerized Adaptive Testing (CAT); the CCSP moved from linear to CAT on 1 October 2025. The current outline lists CAT for the English, Simplified Chinese, German and Japanese exams | ISC2 Insights, May 2025; exam outline, August 2026 |
| Number of items | 100 to 150, multiple choice and advanced item types | Exam outline, August 2026 |
| Maximum time | 3 hours | Exam outline; ISC2 Insights, May 2025 |
| Passing grade | 700 out of 1000 points | Exam outline, August 2026 |
| Delivery | Pearson VUE test centres | Exam outline, August 2026 |
| How CAT starts | With an item well below the passing standard; the estimate of ability is refined with each answer | ISC2 CAT page |
| Current outline | Effective 1 August 2026 | ISC2 CCSP exam outline page |
Three hours for up to 150 items gives a little over a minute per item. The exam may stop at any point from 100 items, so do not read anything into its length.
The six domains
Names and average weights are from ISC2's English outline effective 1 August 2026. The final column is our suggestion of practical reading, not part of the outline.
| Domain | Name | Weight | Main subtopics in the outline | Where to see it in practice |
|---|---|---|---|---|
| 1 | Cloud Concepts, Architecture and Design | 17% | Cloud concepts and reference architecture, security concepts, secure design principles, evaluating cloud providers, AI and machine learning concepts | Cloud Security Guide, Cloud Security Alliance CCM and STAR Guide |
| 2 | Cloud Data Security | 20% | Data lifecycle, storage architectures, data security technologies, discovery and classification, information rights management, retention, deletion and archiving, auditability, AI and ML data protection | Data Classification Guide, Data Loss Prevention (DLP) Guide |
| 3 | Cloud Platform and Infrastructure Security | 17% | Infrastructure components, secure data centre design, infrastructure risk analysis, security controls, business continuity and disaster recovery | CNAPP Guide, Business Continuity and Disaster Recovery Guide |
| 4 | Cloud Application Security | 16% | Security training, secure development lifecycle, assurance and testing, secure coding, verified software and supply chain, cloud application architecture, identity and access management | Application Security Guide, Cloud Workload Identity Guide |
| 5 | Cloud Security Operations | 17% | Building, operating and maintaining physical and logical infrastructure, operational controls and standards, digital forensics, stakeholder communication, security operations management | Cloud Incident Response Guide |
| 6 | Legal, Risk and Compliance | 13% | Legal requirements, privacy, audit processes, enterprise risk management, outsourcing and contract design | GDPR Compliance Guide for Security Teams, EU AI Act Compliance Guide |
ISC2's outline page adds an introductory paragraph on AI to every domain, covering themes such as responsibilities for AI delivered as a service, AI-driven threat hunting, and explainability requirements under regulations such as the GDPR and the EU AI Act. Study material published before August 2026 will not cover these, and the domain weights it quotes may also be out of date.
Where identity fits: the outline names identity and access management in Cloud Application Security, and in practice most cloud incidents turn on identity: over-privileged roles, long-lived access keys, and workload identities nobody owns. Revise cloud IAM policy models, federation and workload identity alongside the data and infrastructure domains. See the Cloud Workload Identity Guide.
Prerequisites and experience
| Rule | What ISC2 publishes (checked October 2026) |
|---|---|
| Total experience | Five years of cumulative, full-time experience in IT |
| Cybersecurity | Three of the five years must be in cybersecurity |
| CCSP domains | One year must be in one or more of the six CCSP domains |
| Part-time and internships | Part-time work of 20 to 34 hours a week counts (1,040 hours equal six months, 2,080 equal twelve); paid or unpaid internships count with letterhead documentation |
| CCSK substitution | CSA's CCSK can substitute for one year of experience |
| Degree waiver | A bachelor's or master's degree in computer science, IT or a related field may satisfy up to one year |
| Waiver limit | Only one year can be waived in total, so a degree and the CCSK do not combine |
| CISSP substitution | An active CISSP may be substituted for the entire CCSP experience requirement |
| Associate route | Pass without the experience and become an Associate of ISC2, with six years to earn the five years required |
Choosing a route
- Active CISSP holders: no further experience evidence beyond keeping the CISSP active; focus your effort on the cloud-specific domains.
- Five years in IT with three in security: check that at least one year maps to a CCSP domain, then follow the full route.
- Four years plus a degree or the CCSK: one waiver brings you to the requirement, but only one.
- Knowledge ready, experience short: the Associate route gives six years to complete the experience.
Endorsement
- Who endorses: another ISC2 certified professional in good standing, using their member ID and surname; ISC2 can endorse instead, with proof of employment.
- Deadline: nine months from the exam date to complete the application, which can be drafted earlier but submitted only after the pass notification.
- Audit: a random percentage of applications is audited, so hold evidence of cloud-related duties ready.
- AMF: paid after approval; if you already hold an ISC2 certification, ISC2 does not charge an additional AMF for the new one.
Preparation plan
The plan assumes ten to twelve weeks of part-time study for an experienced practitioner. ISC2 also sells official self-paced and instructor-led CCSP training, with or without an exam voucher; check the CCSP purchase options for current windows and attempts.
- Confirm eligibility (week 0): decide which route applies (full, CISSP substitution, single waiver or Associate) and identify your endorser.
- Use the August 2026 outline (week 0): download it and use it as your checklist. Reject resources that predate it or describe a linear exam.
- Baseline (week 1): a timed diagnostic across all six domains, with a score per domain.
- Data first (weeks 2 to 4): Cloud Data Security carries 20%. Work through the data lifecycle, encryption and key management options, tokenisation, classification and deletion in a real tenant.
- Weak domains (weeks 5 to 8): engineers usually need most time on Legal, Risk and Compliance (contracts, audit, privacy law); auditors and consultants usually need most time on platform and operations. Use free-tier labs in at least two providers to see shared responsibility in practice.
- AI and new content (week 9): revisit each domain for AI as a service, AI data protection and AI regulation topics.
- Rehearse (weeks 10 to 11): sit at least two full mocks of 150 items in three hours, reading each question for the role and for qualifiers such as first or best.
- Book and sit (week 12): rescheduling costs USD 50 and cancelling USD 100, so pick a date you can keep. Submit the application soon after a pass.
Measuring readiness
- Domain spread: per-domain mock scores, with Cloud Data Security at or above your average.
- Timed performance: full mocks finished within three hours at your target score.
- Cross-provider fluency: you can explain the equivalent identity, key management and logging services in at least two providers.
- Application readiness: endorser and evidence confirmed before exam day.
Small vs large organisations: in a small organisation the candidate may be the only cloud security person and see contracts and audits first hand, but rarely data centre design; budget reading time there. In a large organisation, candidates often work in one slice of cloud security and should borrow time with legal, procurement and platform teams to cover the breadth the exam expects.
Cost, renewal and continuing education
| Item | Amount or rule (ISC2, checked October 2026) |
|---|---|
| Exam fee | USD 599 (Americas, Asia Pacific, Middle East, Africa and unlisted regions); EUR 575.04 (EMEA); GBP 485.19 (United Kingdom). Pricing and taxes depend on exam location |
| Reschedule or cancel | USD 50 to reschedule, USD 100 to cancel (GBP 35 or 70, EUR 40 or 80) |
| Annual maintenance fee | USD 135, due on the cycle start date and each anniversary |
| CPE per three-year cycle | 90 in total: 60 Group A and 30 Group A or B |
| Suggested annual CPE | 30 a year (20 Group A, 10 Group A or B) |
| Grace period | 90 days after the cycle ends for CPE, and 90 days from the AMF due date |
| If missed | Suspension, up to two consecutive years, then termination |
| Associate of ISC2 | AMF USD 50 and 15 CPE a year; upgrade AMF USD 85 after endorsement approval |
ISC2's Certification Maintenance Policy (version 7.0 when checked) defines Group A and Group B activities. If you also hold the CISSP, read the policy on how credits and fees apply across certifications rather than assuming the requirements simply add up.
Common failure patterns
- Revising the pre-August 2026 outline: older material misses the AI content and the current weights, including the 20% weight on Cloud Data Security.
- Studying one provider: the exam is vendor-neutral; answers framed around one provider's service names miss the principle being tested.
- Underrating Legal, Risk and Compliance: it is the smallest domain at 13% but the least familiar to engineers, covering contracts, audit and cross-border privacy.
- Double-counting waivers: candidates assume a degree and the CCSK each remove a year; ISC2 allows only one year to be waived.
- Letting the CISSP lapse: the substitution depends on an active CISSP, so keep its CPE and AMF current through the application.
- Treating identity as a side topic: cloud breaches often start with exposed or over-privileged keys, as in the Imperva breach, where a stolen AWS API key exposed Cloud WAF customers' keys and certificates. Expect identity in data, application and operations questions.
Where it fits on the career path
- Before the CCSP: the CCSK or a provider associate-level credential builds cloud vocabulary; the SSCP Certification Guide covers an operations route for practitioners earlier in their careers.
- With the CISSP: the two share ISC2's maintenance model, and the CISSP waives the CCSP experience requirement. See the CISSP Certification Guide.
- Alongside it: a provider security specialty shows hands-on depth to balance the CCSP's breadth.
- Roles: cloud security engineer, cloud security architect, and cloud assurance or audit roles. See the Cloud Security Engineer Career Guide.
ISC2 does not publish pass rates or salary figures on the pages checked for this guide, and we do not quote third-party estimates. For a comparison by level and specialism, see the Cybersecurity Certifications Guide.
Practitioner checklist
- Work out your route: full, CISSP substitution, single waiver (degree or CCSK) or Associate.
- Download the CCSP outline effective 1 August 2026 and use it as your revision checklist.
- Discard material that predates the August 2026 outline or describes a linear exam.
- Baseline all six domains and start with Cloud Data Security, the largest at 20%.
- Lab shared responsibility, key management and IAM in at least two cloud providers.
- Sit at least two full mocks of 150 items in three hours before booking.
- Confirm your endorser and evidence before exam day and submit within nine months.
- Diarise the AMF and log about 30 CPE credits a year.
Standards and references
- ISC2: CCSP Certified Cloud Security Professional
- ISC2: CCSP Certification Exam Outline
- ISC2: Computerized Adaptive Testing Examination Format Updates
- ISC2: CCSP Experience Requirements
- ISC2: Endorsement
- ISC2: Associate of ISC2
- ISC2: Exam Pricing
- ISC2: Member Policies and Certification Maintenance
Related NHI Mgmt Group resources: Cybersecurity Certifications Guide · CISSP Certification Guide · CCSK Certification Guide · Cloud Security Guide · Cloud Security Engineer Career Guide