FirstTry

Certification guide

CCSP

ISC2 CCSP: the honest guide

CCSP is the cloud half of the ISC2 line. It asks how you design, run and defend an estate whose hardware belongs to somebody else, across six domains that run from architecture and data protection through operations to the legal exposure of putting regulated data in a provider's data center. ISC2 writes it for people responsible for cloud security architecture, design, operations and service orchestration, and names cloud architect, cloud engineer, cloud security analyst and auditor of cloud computing services among the roles that hold it.

The exam is computerized adaptive. ISC2 publishes the format as 100 to 150 items in three hours, multiple choice plus its advanced item types, with a passing grade of 700 out of 1000 points, delivered at a Pearson VUE testing center. The engine estimates your ability as it goes and stops once it is statistically confident you sit above or below the standard, so two candidates can answer very different numbers of questions. The outline being tested took effect on 1 August 2026: Cloud Data Security is the heaviest domain at 20 percent, Legal, Risk and Compliance the lightest at 13 percent, and the other four sit at 16 or 17.

The gate that catches people is not the exam. ISC2 requires five years of cumulative full-time IT experience, three of them in cybersecurity and one in one or more of the six CCSP domains, before it will certify you. A bachelors or masters in computer science, IT or a related field can satisfy up to one year, and CSA's CCSK certificate can substitute for one year, but only one year can be waived in total. An active CISSP substitutes for the entire requirement. Pass without the experience and you become an Associate of ISC2, with six years to earn the five.

Who CCSP is for

A good fit if

  • You work in cloud security, cloud architecture or cloud operations with roughly five years of IT behind you, three of them in security.
  • You already hold CISSP and want the cloud specialism, which is the one case where ISC2 waives the CCSP experience requirement outright.
  • Your employer is moving regulated data into a public cloud and you are the person who has to answer for where it lives, who can reach it and what the contract actually says.
  • You audit cloud providers or cloud consumers and need a vendor neutral credential a client already recognizes.
  • You need a certification approved under the U.S. Department of Defense DoDM 8140.03 framework, which ISC2 lists CCSP under on its certification page.

Probably not, if

  • You are new to security. CCSP assumes five years of IT with three in cybersecurity, and the exam reads as though you have already argued with a provider about where a shared responsibility boundary falls. ISC2 CC or Security+ is the place to start.
  • You want a hands-on cloud exam. CCSP never asks you to build anything, and it is vendor neutral by design, so it tests reasoning rather than a console. A platform security certification on AWS, Azure or Google Cloud fits that goal better.
  • You want a credential tied to the platform your employer actually runs. Staying above any single provider is what makes CCSP useful in an audit and what makes it thin as evidence that you can configure a specific cloud.

Is CCSP worth it?

For someone with the experience working in cloud security, yes. It is the vendor neutral cloud security credential senior cloud roles name, ISC2 lists it as approved under the U.S. Department of Defense DoDM 8140.03 framework, and it carries ANAB accreditation to ISO/IEC standard 17024. The exam is $599, which is real money and is small against what the roles it maps to pay.

For a CISSP holder it is close to the cheapest specialism available. ISC2 substitutes an active CISSP for the whole CCSP experience requirement, and the annual maintenance fee does not increase, because ISC2 bills one fee per member however many of its certifications you hold. The entire cost of adding it is the exam and the study time.

For someone without the five years, not yet. You can pass and hold Associate of ISC2 for up to six years while you accrue the experience, paying a maintenance fee throughout, but you are not a CCSP until the endorsement clears. Years in a cloud role plus a platform certification on the cloud you actually run gets you to the same place in better shape and for less money.

What the exam actually asks you to do

Multiple choice and ISC2's advanced item types. There is no lab and no simulation, so the practice that matters is reading a scenario and choosing well.

Item formats

  • Multiple choice

Nothing here needs a lab. Reading carefully and eliminating options is the whole skill. ISC2, CCSP exam outline ↗

Domain breakdown and official weightings

From the official ISC2 exam outlines. Cloud Data Security is the heaviest domain at 20 percent, followed by Cloud Concepts, Architecture and Design at 17 percent.

  • Cloud Concepts, Architecture and Design17%
  • Cloud Data Security20%
  • Cloud Platform & Infrastructure Security17%
  • Cloud Application Security16%
  • Cloud Security Operations17%
  • Legal, Risk and Compliance13%

Where to focus: Cloud Data Security is the heaviest domain at 20 percent, but the other five sit between 13 and 17 percent, so the CCSP spreads its questions widely and a weak domain is hard to hide. The exam outline that took effect on August 1, 2026 is the one being tested now, so check the effective date on any study material you buy. If you already hold an active CISSP, ISC2 substitutes it for the entire CCSP experience requirement, which leaves the exam as the only step.

ISC2: ISC2 exam outlines ↗

Study plans by experience level

Working across most of the six domains already

8 to 10 weeksat 8 to 10 hours

  1. 1Weeks 1 to 2: read the exam outline against your own work and mark every sub-objective your job has never made you think about. For most working practitioners that is the second half of Legal, Risk and Compliance and the retention, archiving and eDiscovery material inside Cloud Data Security.
  2. 2Weeks 3 to 6: the heaviest domains first. Cloud Data Security at 20 percent gets more hours than anything else in the plan, then Cloud Concepts, Architecture and Design, Cloud Platform and Infrastructure Security, and Cloud Security Operations at 17 percent each.
  3. 3Weeks 7 to 8: Cloud Application Security at 16 percent and then Legal, Risk and Compliance. The legal domain is only 13 percent and it is where a technical candidate loses the most marks, because none of it can be reasoned out from how systems behave.
  4. 4Weeks 9 to 10: timed sets. The exam commits each answer before serving the next, so rehearse deciding and moving on rather than flagging and returning, which the format does not offer.

Deep in one cloud platform, new to the vendor neutral framing

12 to 14 weeksat 8 hours

  1. 1Weeks 1 to 3: learn the vocabulary shift before anything else. CCSP speaks in service and deployment models, shared responsibility, data lifecycle stages and provider obligations rather than in the product names your platform uses, and most of the early difficulty is translation rather than new material.
  2. 2Weeks 4 to 9: work the six domains in weight order, mapping every concept onto something you have actually built. A control you can point at in your own estate stays learned; a definition you read does not.
  3. 3Weeks 10 to 12: the governance material. Legal, Risk and Compliance is 13 percent on its own, and the risk, audit and vendor management content inside Cloud Security Operations sits next to it. Together they are where a strong engineer is thinnest.
  4. 4Weeks 13 to 14: full timed sets, tracking accuracy by domain and spending each remaining session on whatever the last set exposed.

Holding CISSP, adding the cloud specialism

5 to 6 weeksat 6 hours

  1. 1Read the exam outline first and mark only what CISSP did not cover. The management framing carries over intact. What does not is the cloud specific detail: virtualization and hypervisor security, container and serverless concerns, and the parts of Cloud Data Security that exist only because somebody else holds the disk.
  2. 2Take a full timed set at the end of week one. It separates the domains where CISSP knowledge transfers cleanly from the ones where the cloud changes the answer, which is faster than reading to find out.
  3. 3Weeks 2 to 4: study the marked items and nothing else. Re-reading governance you already know at CISSP depth feels productive and moves your score very little.
  4. 4Weeks 5 to 6: timed sets under adaptive conditions, plus a pass through the exam outline's own vocabulary. ISC2 marks its terms rather than your platform's.

Common mistakes

Answering from the platform you know
CCSP is vendor neutral, so the right answer is the one that holds for any provider rather than the one your cloud implements. A key management question wants the reasoning about who holds the key and who can be compelled to hand it over, not the name of the service you would click.
Leaving Legal, Risk and Compliance until last
It is the smallest domain at 13 percent and the furthest from a technical candidate's instincts. Jurisdiction, contract terms, privacy regimes and audit obligations cannot be derived from first principles, and meeting them for the first time in the final tired week is how a well prepared candidate loses the marks that decide the result.
Treating the adaptive format like a fixed paper
You cannot flag an item and come back to it. Each answer is committed before the next is served, and the exam ends anywhere between 100 and 150 items. Rehearse pacing under those rules rather than under rules this exam does not use.
Booking before checking the experience requirement
Five years of cumulative full-time IT, three in cybersecurity and one in a CCSP domain. Passing without that makes you an Associate of ISC2 rather than a CCSP, with six years to earn the shortfall and a maintenance fee due the whole time. It is a reasonable plan when you choose it and an unpleasant surprise when you do not.
Studying an outline that has been replaced
The CCSP exam outline in force took effect on 1 August 2026. Material written against an earlier one still teaches cloud security, and it can carry the wrong weightings and miss sub-objectives that are examinable now. Check the effective date printed on anything you buy.

What comes after passing

Passing is not the last step. ISC2 verifies your experience through an endorsement application that has to be endorsed and digitally signed by an ISC2 certified professional in good standing, and ISC2 will act as endorser if you do not know one. The credential is not yours until that clears and the first annual maintenance fee is paid.

The cycle then runs three years: 90 CPE credits, at least 60 of them Group A and therefore related to the domains you hold, plus the annual maintenance fee each year. ISC2 suggests 30 credits a year and states there is no annual requirement unless you hold associate status, so an uneven year is fine as long as the cycle total lands. Log the credits as you earn them; reconstructing three years of them in the final month is its own project.

From here the useful moves are sideways rather than up. CISSP is the broader senior credential and substitutes for the CCSP experience requirement in the other direction. CGRC suits anyone whose cloud work turned out to be mostly authorization and audit. A platform security certification on the cloud you actually run pairs well with a vendor neutral one. Because ISC2 charges a single maintenance fee per member, any of them adds study time and no new recurring cost.

Costs across the full renewal cycle are on the CCSP cost page.

Frequently asked questions

How much does the CCSP exam cost?

ISC2 lists standard registration at U.S. $599 in the Americas, Asia Pacific, the Middle East and Africa, EUR 575.04 in EMEA and GBP 485.19 in the United Kingdom, and says pricing and taxes are based on where the exam is administered. A retake is the same price again, and ISC2 charges separate fees to reschedule or cancel an appointment.

Do I need five years of experience to take the CCSP exam?

You need it to be certified, not to sit. ISC2 requires five years of cumulative full-time IT experience, three in cybersecurity and one in one or more of the six CCSP domains. Pass without it and you become an Associate of ISC2 with six years to earn the five. A relevant degree or CSA's CCSK can waive one year, only one year can be waived in total, and an active CISSP substitutes for the whole requirement.

What score do I need to pass the CCSP?

700 out of 1000 points. The exam is computerized adaptive, so it serves between 100 and 150 items over three hours and ends once it is statistically confident you are above or below that standard rather than running a fixed length for every candidate.

How long do I have to wait to retake the CCSP?

ISC2 lets you retest 30 test-free days after a first attempt, 60 test-free days after a second, and 90 test-free days after a third attempt and every one after that. You may sit an ISC2 exam at most four times in any 12 month period for a given certification program.

Is CCSP harder than CISSP?

It is narrower and deeper rather than harder. CISSP covers eight domains across a whole security program at management level, while CCSP covers six and goes further into cloud specific detail, so it asks more cloud knowledge and less breadth. For a CISSP holder the study is shorter, because the governance framing carries over and only the cloud material is new, which is part of why ISC2 accepts an active CISSP in place of the CCSP experience requirement.

What does it cost to keep the CCSP?

A single annual maintenance fee of U.S. $135, due each year on the anniversary of your certification date, plus 90 CPE credits across the three year cycle with at least 60 of them Group A. ISC2 bills one maintenance fee per member however many of its certifications you hold, so a second ISC2 certification adds no recurring cost.

Keep reading

Every guide and cost breakdown, by vendor

Practice CCSP for free while you decide

Original questions written from the published objectives, with the concept, the reasoning, and a note on every wrong option. No account needed to start.

Start free CCSP questions