Skip to content
CertGPS
News and updates

The August 2026 CCSP Outline: AI Objectives and a One-Point Swap

The CCSP outline in effect since August 1, 2026 adds two AI objectives, names AI in two more and moves a point between domains 4 and 5. What older books miss.

RB
Rachel Brown
Security Researcher
Published
Updated
Read time
3 min
On this page

Related certifications

Topics

The August 2026 CCSP Outline: AI Objectives and a One-Point Swap

Anyone sitting the CCSP today is tested on the outline that took effect on August 1, 2026, replacing the one in force since August 2022. The six domains keep their names. ISC2 added two objectives on artificial intelligence (AI) and machine learning (ML), wrote AI into two others, and moved one point of weight from application security to operations. Most of what you studied from 2022 material still applies.

Objective by objective, against 2022

The two new objectives are:

  • 1.6, Comprehend AI/ML: cloud threat detection and analysis, validating and verifying data sources, security orchestration, automation and response (SOAR), ethical concerns and regulatory requirements.
  • 2.9, Comprehend data protection of AI and ML data: the privacy and security of data sets and models, including their validation and verification.

Two existing objectives now name AI. Objective 4.1 lists the OWASP Top 10 for Large Language Model Applications among the common cloud vulnerabilities, next to the OWASP Top 10, the Application Security Verification Standard and the SANS Top 25. Objective 5.6 adds AI to the tools for monitoring security controls, beside firewalls, intrusion detection and network security groups.

A few objectives were reworded. Objective 3.1 drops "platform" and now reads "Comprehend cloud infrastructure components". Objective 4.6 became "Comprehend and apply the specifics of cloud application architecture", and 6.2 asks you to understand privacy requirements where the 2022 version said privacy issues.

The weights moved by a point in two places, according to the 2022 domain refresh document and the current outline:

  • Cloud Application Security (Domain 4): 17% to 16%
  • Cloud Security Operations (Domain 5): 16% to 17%

Cloud Data Security stays the largest domain at 20%, and Legal, Risk and Compliance the smallest at 13%.

What ISC2 gave as the reason

ISC2's June 30, 2026 announcement said the domains, weights and subdomains had been "revisited and revised" through a job task analysis. It asked CCSP holders for input in January 2024, ahead of a workshop it scheduled for February 2024. The announcement also quoted ISC2's 2025 Cybersecurity Workforce Study: among respondents focused on cloud skills, 50% called out cloud architecture and secure design, 41% cloud platform and infrastructure security, and 38% secure cloud deployment and configuration management. Those are survey answers about skills in demand, not exam weights, and the weights barely moved.

The format changed ten months earlier

The CCSP has been an adaptive exam since October 1, 2025. You get 100 to 150 items in three hours, no going back to an earlier item, and a stop once the engine is 95% confident about your result. The pass mark is 700 out of 1000. Languages are English, Chinese, German and Japanese, with Chinese offered only in set windows. The price in the Americas is $599, with $50 to reschedule and $100 to cancel.

What to do if you're sitting it this autumn

Start from the 15-page outline PDF, not a book. Wiley lists the fourth edition of Mike Chapple and David Seidl's CCSP Study Guide, which adds AI coverage, for December 2026. Until then, any book from 2022 was written to the previous outline. If you use one, read objectives 1.6, 2.9, 4.1 and 5.6 in the outline and fill them from primary material: the OWASP Top 10 for LLM applications for 4.1, and your cloud provider's documentation on protecting training data and model endpoints for 2.9.

The experience rule didn't change: five years in IT, three of them in cybersecurity and one in a CCSP domain, with an active CISSP covering the whole requirement. For how the August change sits with ISC2's other 2026 updates, see CISSP in 2026. For the route into cloud work, see cloud security from basics to CCSP.

Sources