Skip to content
CertGPS

Certified Cloud Security Professional

Vendor-neutral proof that you can secure cloud architecture, data and operations, and handle the legal and contract side of cloud services

AdvancedISC2

The exam

Exam cost
$599
Study time
4-8 months
Passing score
700 out of 1000
Valid for
3 years

Before you book

  • Required: five years of cumulative full-time IT experience, three in cybersecurity and one in a CCSP domain
  • An active CISSP substitutes for the entire experience requirement
  • A relevant degree or CSA's CCSK can waive one year (one year maximum)
  • Without the experience: pass to become an Associate of ISC2, with six years to qualify

What it covers

Security domains

Career

US pay and outlook from the Bureau of Labor Statistics for the closest BLS occupation to each role this certification fits. BLS doesn't report pay by certification, and counts most of these roles only within a wider occupation, so the figures describe that occupation, not the role or the credential.

Where people with it work

  1. Entry level

  2. Mid level

  3. Senior level

Where it leads

  1. Certified Information Systems Security Professional

    Expert

    Comes before. An active CISSP waives the whole CCSP experience requirement, and both share one annual fee

  2. Certified Cloud Security Professional

    You are here

Study guide

Last updated

CCSP Study Guide: The August 2026 Outline, the Experience Rule and a Plan

The Certified Cloud Security Professional (CCSP) is ISC2's credential for people who secure systems they don't fully own: cloud architecture, data protection, platform operations, and the laws and contracts that come with a provider. It asks for five years of IT experience, although an active CISSP covers the whole requirement. Check the date on your study materials before anything else. The exam moved to a new outline on August 1, 2026, and that outline now names artificial intelligence (AI) and machine learning (ML) in four objectives.

Who should sit the CCSP, and who should pick a cloud vendor's exam

ISC2 lists cloud architects, engineers, consultants and auditors of cloud services among the people it writes the exam for. In practice it suits a security engineer or architect with at least a year of cloud work who now has to answer auditors, lawyers and procurement as well as engineers. A CISSP holder moving into cloud work gets the most from it. ISC2 waives the experience check for them entirely, and much of the governance material will already be familiar.

If your job is building and hardening one provider's platform, that provider's exam tests the work more directly: AWS Security Specialty, Azure Security Engineer or Google Professional Cloud Security Engineer. Kubernetes administrators who spend their days on cluster hardening will learn more from CKS. If you have fewer than three years in cybersecurity, you can still pass, but you'll hold the Associate of ISC2 title rather than CCSP until your experience catches up.

CCSP exam facts

Exam factDetail
FormatComputerized adaptive testing (CAT); multiple choice and advanced item types
Questions100 to 150
Time3 hours
Passing score700 out of 1000
Price (Americas)$599; $50 to reschedule, $100 to cancel
DeliveryPearson VUE test centers, in English, Chinese, German or Japanese
ExperienceFive years of cumulative full-time IT work, three in cybersecurity and one in a CCSP domain; an active CISSP replaces all of it
Without the experiencePass and become an Associate of ISC2, with six years to earn the five
RenewalThree-year cycle, 90 CPE credits, $135 annual maintenance fee

Inside the six domains of the 2026 outline

Average weights from the outline effective August 1, 2026:

  • Cloud Concepts, Architecture and Design: 17%
  • Cloud Data Security: 20%
  • Cloud Platform and Infrastructure Security: 17%
  • Cloud Application Security: 16%
  • Cloud Security Operations: 17%
  • Legal, Risk and Compliance: 13%

Cloud Data Security is the largest domain, and it reaches well past encryption. Its nine objectives cover data discovery, classification, information rights management, retention and deletion policies, and the audit trail of data events. The other five domains sit between 13 and 17 percent.

The AI material is spread across four domains. Objective 1.6 covers AI and ML for cloud threat detection, validating data sources, security orchestration, automation and response (SOAR), ethics and regulation. Objective 2.9 adds the privacy and security of training data and models, 5.6 lists AI among the tools for monitoring security controls, and 4.1 now names the OWASP Top 10 for Large Language Model Applications alongside the OWASP Top 10 and the Application Security Verification Standard (ASVS).

Legal, Risk and Compliance is the domain we'd expect engineers to find least familiar. It expects you to know eDiscovery under ISO/IEC 27050, the forensic standards ISO/IEC 27037 to 27043, how SSAE, SOC and ISAE audit reports differ and where their scope stops, and contract terms such as right to audit, escrow and vendor lock-in. Privacy questions can cite GDPR, HIPAA, FERPA, PIPEDA and ISO/IEC 27018.

ISC2's adaptive engine stops once it is 95% confident you're above or below the pass mark, after at least 100 items, and it never lets you go back to an earlier question. Practise committing to an answer on the first read.

A study plan for a vendor-neutral cloud exam

Start from the August 2026 outline PDF, 15 pages, and mark every bullet you couldn't explain to a colleague. Then choose your main text with the date in mind. Wiley lists the fourth edition of Mike Chapple and David Seidl's CCSP Study Guide, written for the new objectives with added AI coverage and two practice exams, for December 2026. The third edition, from October 2022, predates the current outline, so if you use it, fill objectives 1.6, 2.9, 4.1 and 5.6 from the outline and the OWASP list. ISC2's own online self-paced training is built on the current domains, and its free CCSP flash cards help with the vocabulary.

Spend roughly a fifth of your hours hands-on, mostly for Domains 2, 3 and 5. In one provider's free tier, create a managed encryption key, encrypt a storage bucket with it, switch on access logging for that data, and write an identity policy that lets one role read objects but not delete them. Then find the same controls in a second provider's documentation. The exam words everything in generic terms, and translating between two providers is good practice for that.

For Domain 6, read a real assurance report if your employer receives one from a provider, and compare a provider's standard contract against the outline's list of contract terms. The Cloud Security Alliance's Certificate of Cloud Security Knowledge (CCSK) is worth a look if you're short of experience. It counts as one of the five years, and its open-book exam is 60 questions in 120 minutes for $445, including two attempts. A degree can also waive a year, but ISC2 allows only one waived year in total.

Leave the last two weeks for timed practice in 100 to 150 question sets, with no going back.

Keeping the CCSP, and what to earn next

Passing doesn't make you a CCSP yet. You submit an endorsement application signed by an ISC2-certified professional in good standing (ISC2 can act as endorser if you don't know one), then pay the first annual maintenance fee (AMF) of $135. You pay a single AMF however many ISC2 certifications you hold. Each three-year cycle needs 90 continuing professional education (CPE) credits, at least 60 of them Group A, which means tied to the CCSP domains. ISC2 suggests 30 a year.

If you fail, you can retest after 30 days, then after 60, then after 90, with no more than four attempts in 12 months.

Where to go next:

Our view

CCSP is at its best as a bridge between cloud engineering and governance. Few cloud exams ask about eDiscovery, the scope of an audit report or a right-to-audit clause, and those are the questions procurement and audit teams bring to cloud architects. It's criticised for the same thing. You can pass without configuring anything, and the vendor-neutral wording can feel far from any real console. At $599 plus $135 a year, we think it pays off for a CISSP moving into cloud architecture or a consultant who assesses providers. An engineer who works on one platform should take that platform's exam first, and anyone starting from scratch this autumn should wait for the December 2026 edition of the study guide.

Sources