CCSP study guide
The Certified Cloud Security Professional (CCSP) from ISC2 validates advanced skills in designing, managing, and securing data, applications, and infrastructure in the cloud. It's often paired with CISSP.
Details below were checked in October 2026 against official and widely cited sources. Exams, prices, and requirements change, so confirm with the certifying body before you register.
Outline update: ISC2 introduced a refreshed CCSP exam outline on August 1, 2026. The six domains remain, AI and machine learning topics are woven into several of them, and the weights shifted slightly.
Eligibility
- Five years of cumulative, paid, full-time IT experience, including three years in information security and one year in one or more of the six CCSP domains.
- A relevant degree can satisfy up to one year. Earning CSA's CCSK can also substitute for one year.
- An active CISSP satisfies the entire experience requirement.
- No experience yet? Pass the exam to become an Associate of ISC2 while you build it.
Exam format & cost
| Format | Computerized adaptive testing. Check ISC2 for the current item count and time limit |
|---|---|
| Passing score | 700 out of 1000 |
| Exam fee | Check ISC2 (regional pricing) |
| Maintenance | ISC2 annual maintenance fee (one fee covers all your ISC2 certifications) plus CPE credits each three-year cycle |
Domains
| Domain | Weight |
|---|---|
| 1. Cloud Concepts, Architecture and Design | 17% |
| 2. Cloud Data Security | 20% |
| 3. Cloud Platform and Infrastructure Security | 17% |
| 4. Cloud Application Security | 16% |
| 5. Cloud Security Operations | 17% |
| 6. Legal, Risk and Compliance | 13% |
Weights for the August 2026 outline as reported by training providers. Confirm against ISC2's exam outline PDF.
How to study
- Master the shared responsibility model for IaaS, PaaS, and SaaS. It underpins many questions.
- Know the cloud data lifecycle (create, store, use, share, archive, destroy) and which controls apply at each stage.
- Expect legal, privacy, and contract questions: data residency, eDiscovery, and assurance reports such as SOC 2 and CSA STAR.
- If you hold CISSP, focus on cloud-specific architecture and operations rather than general security.
Ready to test yourself on CCSP?
Start CCSP practice