CCSP Exam Guide 2026: New Outline, Domains, Pass Mark

CCSP (Certified Cloud Security Professional) is ISC2’s credential for people who design, build and run secure cloud environments. Where CISSP proves breadth across all of security, CCSP proves depth in one place: how data, applications and infrastructure are protected when they live on someone else’s platform.

ISC2 introduced a new CCSP exam outline effective 1 August 2026, with revised domain weights and subdomains. Anything you sit from that date onward is based on the new outline, regardless of when you registered — so check that your study materials were written for it.

The CCSP exam format: adaptive (CAT)

ISC2 delivers CCSP using Computerized Adaptive Testing (CAT), the same model it uses for CISSP. You see between 100 and 150 items in up to three hours. Each answer updates the exam’s estimate of your ability, and the next item is chosen to measure you more precisely. The test ends once the result is statistically clear, or when you reach the maximum number of items or run out of time.

Two practical consequences: you cannot skip ahead or go back to change answers, and finishing at 100 items says nothing on its own about whether you passed. Treat every item as final and keep a steady pace of a little over a minute per question.

The 6 CCSP domains and their 2026 weights

The six domains are unchanged in name; what moved is how much of the exam each one carries and what sits inside them. Cloud Data Security is now the single heaviest domain at 20%.

• Cloud Concepts, Architecture and Design (17%) — service and deployment models, shared responsibility, secure reference architectures and design principles.
• Cloud Data Security (20%) — the data lifecycle, classification, encryption and key management, data loss prevention, and data retention and deletion in the cloud.
• Cloud Platform and Infrastructure Security (17%) — securing compute, storage, network and virtualisation layers, plus business continuity on cloud infrastructure.
• Cloud Application Security (16%) — secure development in cloud environments, application architecture, identity for applications, and testing.
• Cloud Security Operations (17%) — operating and monitoring cloud environments, incident handling, logging and digital forensics in the cloud.
• Legal, Risk and Compliance (13%) — jurisdiction, privacy, contracts, audit and assurance, and managing cloud vendor risk.

What the questions are really like

CCSP items are scenarios. A typical question describes an organisation, a cloud service model and a constraint — a regulator, a data type, a contract — and asks what the security professional should do first or recommend. More than one option is usually technically valid; the right one fits the shared-responsibility model and the business context described.

The common miss is answering as an on-premises engineer. If the scenario is SaaS, the customer cannot patch the hypervisor; if the data crosses borders, the legal answer may beat the technical one. Read every question for who owns what before you look at the options.

Experience requirements

To be certified you need five years of cumulative, paid IT work experience, of which three years must be in information security and one year in one or more of the six CCSP domains. Holding the CSA CCSK certificate can substitute for the one year in the CCSP domains, and holding CISSP can substitute for the entire requirement. Without the experience you can still pass the exam and become an Associate of ISC2 while you earn it.

ISC2 adjusts these rules from time to time, so confirm them on the ISC2 site before you book.

A study plan for the new outline

Because the exam is adaptive, consistency across all six domains matters more than excellence in two. A plan that works:

• Download the current ISC2 outline and use its subdomains as your checklist.
• Start with a diagnostic and rank the six domains; spend most of your time on the weakest, weighted toward Cloud Data Security (20%).
• Study 30–45 focused minutes a day, and review missed concepts on a spaced schedule rather than rereading.
• Practise scenario questions under a clock and write one line on why the best answer beats the runner-up.
• Book the exam when your scores are stable across every domain, not when one good practice test lands.