Skip to content
CertGPS
Comparison

CCSP or CISSP: Cloud Depth, Program Breadth, and Which to Earn First

An active CISSP clears CCSP's whole experience rule, while CCSP waives one CISSP year. Who each ISC2 exam suits, what the 2026 CCSP outline adds, and the order.

JW
Jennifer Williams
Security Architect
Published
Updated
Read time
4 min
On this page

Related certifications

Topics

CCSP or CISSP: Cloud Depth, Program Breadth, and Which to Earn First

CISSP covers a whole security program across eight domains. CCSP takes the cloud part of that program and goes much further into it, from key management to the clauses in a provider contract. Both come from ISC2, and for most readers one rule settles the order. An active CISSP replaces CCSP's entire experience requirement, while CCSP can only waive one of CISSP's five years.

The two exams side by side

CCSPCISSP
IssuerISC2ISC2
FormatComputerized adaptive testing (CAT); multiple choice and advanced item typesComputerized adaptive testing (CAT); multiple choice and advanced item types
Questions100 to 150100 to 150
Time3 hours3 hours
Passing score700 out of 1000700 out of 1000
Outline in forceEffective August 1, 2026Effective April 15, 2024
Price (Americas)$599$749
ExperienceFive years in IT, three of them in cybersecurity and one in a CCSP domain; an active CISSP replaces all of itFive years in two or more of the eight domains; a degree or an approved credential waives one
Renewal$135 a year and 90 CPE credits per three-year cycle$135 a year and 120 CPE credits per three-year cycle

Who each one is written for

ISC2 lists cloud architects, cloud engineers, consultants, administrators, security analysts and auditors of cloud services as the people CCSP is meant for. In practice it fits an engineer or architect whose systems mostly run on someone else's infrastructure, and who now has to answer procurement and audit as well as fix configurations.

CISSP suits a security engineer heading into architecture, a security manager, or a consultant who advises on whole programs. Cloud is only a small part of it. Objective 3.5 lists cloud-based systems (software, platform and infrastructure as a service) among the architectures you should be able to assess, objective 8.4 covers the security of acquired cloud services, and objective 2.6 names the cloud access security broker. CCSP spends six domains on the same territory.

If your work is hardening one provider's platform, that provider's exam tests it more directly than either: AWS Security Specialty, Azure Security Engineer or Google Cloud Security Engineer. Our cloud security engineer career path puts those exams in order.

What each outline asks of you

The CCSP outline that took effect on August 1, 2026 gives Cloud Data Security the largest share at 20%, and that domain goes well past encryption into data discovery, classification, information rights management, retention and legal hold. The new outline also names artificial intelligence (AI) and machine learning in four objectives: AI for threat detection in 1.6, the privacy and security of training data and models in 2.9, the OWASP Top 10 for Large Language Model Applications in 4.1, and AI among monitoring tools in 5.6. Legal, Risk and Compliance carries 13%. It's the domain we'd expect engineers to find least familiar, with questions on eDiscovery under ISO/IEC 27050, how the scope of an SSAE or ISAE audit report is restricted, and contract terms such as right to audit and escrow.

The CISSP outline is wider and shallower. Its heaviest domain, Security and Risk Management, carries 16%, and the rest sit between 10% and 13%, so physical security, network design, security models and software development all get roughly equal room. ISC2 hasn't replaced the April 2024 outline, though in April 2026 it published guidance on how AI topics appear across all eight domains.

The format is identical. ISC2 delivers both exams adaptively, a finalized answer can't be reviewed or changed, and once you've answered 100 items the test ends as soon as the algorithm is 95% confident you're above or below the pass mark. Preparation for one trains the habit the other needs: pick the answer a security adviser would give the organization, then move on.

Which order works, and what each counts toward

Take CISSP first if you already have five years across two of its domains. Once you hold it, ISC2 drops CCSP's experience check entirely, and the cloud exam becomes a question of study time and $599.

Take CCSP first if your career has been mostly cloud work and CISSP's breadth is a long way from what you do. CCSP counts general IT years, provided three of the five are in cybersecurity. CCSP then sits on ISC2's list of credentials that waive one CISSP year, but ISC2 waives only one year in total, so it adds nothing if a degree has already covered that year.

Pass either exam short of the experience and you become an Associate of ISC2 with six years to earn it. Holding both costs one annual maintenance fee, since ISC2 charges a single $135 however many of its certifications you hold. ISC2 lists both as approved under the US Defense Department's DoDM 8140.03 manual. Our ISC2 certification path shows where the two sit among ISC2's other credentials.

Our view

For anyone who wants both, we'd sit CISSP first in nearly every case. The waiver logic favors it, and CISSP's breadth is useful context when a CCSP question turns on governance or law. The exception is the cloud engineer three or four years into the field who hasn't yet built CISSP's two-domain experience and whose employer needs cloud credentials now. That person should sit CCSP and treat CISSP as the next step.

If you're starting CCSP this autumn, check the date on every book you buy. Compare its contents with the August 2026 outline, especially the four AI objectives; a publication date alone doesn't establish coverage.

Sources