Certified Cloud Security Professional credential artwork

Certified Cloud Security Professional (CCSP) Exam Guide

Validates knowledge of securing cloud environments, including architecture, data, platforms, applications, operations and cloud legal and compliance requirements.

CCSP tests whether you can make sound security decisions across the cloud lifecycle: choosing architectures, protecting data, securing platforms and applications, running operations and meeting legal and contractual duties. Prepare across all six domains, including the ones outside your day job, and practise picking the best vendor-neutral answer for the business and its risks.

Understand the exam

Syllabus

1Cloud concepts, architecture and design17%
  1. 1.1Understand cloud computing concepts
  2. 1.2Describe cloud reference architecture
  3. 1.3Understand security concepts relevant to cloud computing
  4. 1.4Understand design principles of secure cloud computing
  5. 1.5Evaluate Cloud Service Providers (CSP)
  6. 1.6Comprehend Artificial Intelligence (AI)/Machine Learning (ML)

Example scenario: A business unit wants to move a customer portal to a SaaS product. Which responsibilities stay with your organization, and how would you assess the provider before signing?

2Cloud data security20%
  1. 2.1Describe cloud data concepts
  2. 2.2Design and implement cloud data storage architectures
  3. 2.3Design and apply data security technologies and strategies
  4. 2.4Implement data discovery
  5. 2.5Plan and implement data classification
  6. 2.6Design and implement Information Rights Management (IRM)
  7. 2.7Plan and implement data retention, deletion, and archiving policies
  8. 2.8Design and implement auditability, traceability, and accountability of data events
  9. 2.9Comprehend data protection of Artificial Intelligence (AI) and Machine Learning (ML) data

Example scenario: Developers want to copy production customer records into a cloud analytics service to train a model. What controls would you require before approving it?

3Cloud platform and infrastructure security17%
  1. 3.1Comprehend cloud infrastructure and platform components
  2. 3.2Design a secure data center
  3. 3.3Analyze risks associated with cloud infrastructure and platforms
  4. 3.4Plan and implementation of security controls
  5. 3.5Plan business continuity (BC) and disaster recovery (DR)
4Cloud application security16%
  1. 4.1Advocate training and awareness for application security
  2. 4.2Describe the Secure Software Development Life Cycle (SDLC) process
  3. 4.3Apply the Secure Software Development Life Cycle (SDLC)
  4. 4.4Apply cloud software assurance and validation
  5. 4.5Use verified secure software
  6. 4.6Comprehend and apply the specifics of cloud application architecture
  7. 4.7Design appropriate Identity and Access Management (IAM) solutions

Example scenario: A team plans to store API keys in a container image to speed up deployment. What risk would you raise, and what alternative would you propose?

5Cloud security operations17%
  1. 5.1Build and implement physical and logical infrastructure for cloud environment
  2. 5.2Operate and maintain physical and logical infrastructure for cloud environment
  3. 5.3Implement operational controls and standards
  4. 5.4Support digital forensics
  5. 5.5Manage communication with relevant parties
  6. 5.6Manage security operations
6Legal, risk and compliance13%
  1. 6.1Articulate legal requirements and unique risks within the cloud environment
  2. 6.2Understand privacy issues
  3. 6.3Understand audit process, methodologies, and required adaptations for a cloud environment
  4. 6.4Understand implications of cloud to enterprise risk management
  5. 6.5Understand outsourcing and cloud contract design

Example scenario: Your provider can only keep backups in a region outside the country where your customers live. Which legal and contractual questions would you resolve first?

Official CCSP exam outline · Effective August 1, 2026

Format

Questions
100–150
Duration
3h
Passing score
700 / 1000
Delivery
Test centre
Languages
English, Chinese, German, Japanese

Question types

Choose the single best answer from the listed options; one is correct and the others are distractors.

CertUp example

A company stores customer records in a SaaS application. Under the shared responsibility model, which duty stays with the company?

  1. Patching the provider's servers
  2. Deciding which employees can access the data
  3. Maintaining the provider's data centre
  4. Updating the provider's hypervisor
Show answer

Deciding which employees can access the data. In SaaS the provider runs the infrastructure and application, while the customer still controls its data and user access.

Eligibility and booking

Experience required for certification

5 years in IT, including 3 in cybersecurity

Required

At least one of those years must be in one or more of the six CCSP domains. Experience is checked through endorsement after you pass.

Standard route5 years IT, 3 in cybersecurity, 1 in a CCSP domain
Relevant degree or CSA CCSK4 years; only one year can be waived
Active CISSPCovers the whole experience requirement

You can sit the exam first. Without the experience you become an Associate of ISC2 and have six years to earn it. After passing, submit your endorsement within nine months.

Create an ISC2 account, buy the exam and schedule with Pearson VUE. After passing, submit your endorsement and pay the first annual fee.

Register for an examISC2 exam pricing

Make a study plan

Rate yourself against the six domains first. Coming from cloud engineering, plan extra time for legal, risk and compliance; coming from governance, for platform and application security.

Most candidates spend 60–150 hours. Plan for the low end if you hold a CISSP or already work with cloud security; plan for the high end if cloud platforms or cloud compliance are new to you.

12 weeksto be ready
  1. 1Understand the examRead the syllabus and format, check you’re eligible and pick a target date.6 h
  2. 3Learn the core conceptsWork through one main course or book, topic by topic.72 h
  3. 4Practice with mock examsTake timed practice tests and review every mistake.36 h
  4. 5Prepare for exam dayBook the exam and check the ID and delivery rules.6 h

Learn the core concepts

Choose one main course for the August 2026 outline. Add a live bootcamp only if you want instructor-led structure.

Best video courseISC2 CCSP Full Course & Practice Exam (2026)Jason Dion, Dion Training · $20 · lifetime accessBest live bootcamp5-Day CCSP Online BootcampDestination Certification · $2,497 one-time or $449/month for 6 months · 1 year accessBest official courseCCSP Online Self-Paced TrainingISC2 · Shown at checkout · 90 or 180 days · members save 20%
See all 5 CCSP courses →

Answer for the business, not the platform. Questions are vendor-neutral. Pick the answer that fits the organization’s risk, legal duties and the shared-responsibility split, not a specific provider’s feature.

Practice with mock exams

Use a question bank to find weak domains, and read every explanation. Practise in timed sets so you can commit to an answer without returning to it.

Official CCSP Flash CardsISC2 · Free · short sign-up formDestCert Exam Prep appDestination Certification · Free · iOS and AndroidISC2 CCSP Practice ExamsCertPreps · 3 exams free · more at $3.50 each
See all 7 CCSP practice tests →

Are you ready?

  • You can explain the main concepts in all six domains, including the ones outside your role.
  • You can say which party is responsible for a control in each cloud service model.
  • You can finish timed sets at a steady pace without relying on going back.

Prepare for exam day

CCSP is taken at a Pearson VUE test centre. Prepare for check-in and the adaptive format.

  • Bring the accepted identification listed in your Pearson VUE confirmation, with a name that matches your booking.
  • Arrive early for check-in and expect security checks, including palm-vein scanning where used.
  • Read each question fully before you submit; you cannot return to it.
  • Pace yourself against the three-hour clock rather than the question number. Breaks use your exam time.
  • Collect your provisional result, then follow ISC2’s instructions for endorsement or Associate status.

ISC2 exam registration

Advice from exam takers