CCSP in 2026: August Outline, AMF Rule and a 10-Week Plan

Last updated September 2026

CCSP asks one question in a hundred different ways: can you secure data and workloads in the cloud no matter whose cloud it is? ISC2’s Certified Cloud Security Professional is vendor-neutral. It tests principles that apply across AWS, Azure, Google Cloud and SaaS, plus the legal, risk and compliance questions that come with putting data in someone else’s data center.

A revised outline took effect August 1, 2026. The six domains stay, but ISC2 revisited the weights and subdomains and added explicit AI and machine learning topics, including two new subdomains (ISC2). It’s a computerized adaptive exam with 100 to 150 items and a three-hour limit. Check that your study materials say August 2026.

CISSP holders: read this first

If you hold an active CISSP, CCSP gets much simpler. Your CISSP satisfies the entire CCSP experience requirement, and ISC2 charges one annual maintenance fee no matter how many of its certifications you hold. That’s why CISSP then CCSP is such a common sequence. CISSP proves breadth; CCSP proves you can go deep on cloud. See our CISSP vs CCSP comparison for which to take first.

From Donald: Would I add CCSP after CISSP? Yes. It is a good step for cloud work.

Where CCSP fits, and when a vendor cert is smarter

Cloud security engineers and architects
Cloud engineers, admins and consultants who own security for cloud workloads
Security analysts and auditors who assess cloud providers and services
CISSP holders who want to show cloud depth

ISC2 lists roles such as cloud architect, cloud engineer, cloud consultant, cloud administrator, cloud security analyst and auditor of cloud computing services as typical CCSP holders (ISC2).

If your whole job lives in one provider, a platform cert may help you more day to day. AWS Certified Security – Specialty, for example, proves hands-on skill on AWS. CCSP is the better pick when you work across providers, advise on contracts and compliance, or want a credential that outlives any one platform.

CCSP exam facts

Item	Details
Current exam outline	Effective August 1, 2026
Format	Computerized Adaptive Testing (CAT)
Number of items	100 to 150
Time limit	3 hours
Item types	Multiple choice plus ISC2’s advanced item types
Passing score	700 out of 1,000
Languages	English, Chinese, Japanese and German (Chinese only in set appointment windows)
Where you test	Pearson VUE test centers
Experience required	Five years in IT, including three in cybersecurity and one in a CCSP domain (waivers and Associate path below)
Exam price (Americas)	$599
Annual maintenance fee	$135 a year ($50 as an Associate of ISC2)
Renewal	Three-year cycle: 90 CPE credits (at least 60 Group A) plus the annual fee

Sources: ISC2’s CCSP exam outline, exam pricing, annual maintenance fee FAQ and member policies. Prices vary by region, so confirm at checkout.

What the August 2026 outline covers

Domain	Weight	What it covers
1. Cloud Concepts, Architecture and Design	17%	Cloud roles and characteristics, reference architecture, service and deployment models, cryptography and key management, virtualization and container security, secure design principles, evaluating cloud providers, and a new subdomain on AI/ML (threat detection, data validation, SOAR, ethics and regulation)
2. Cloud Data Security	20%	The cloud data life cycle, storage types and threats, encryption, hashing, masking, tokenization, DLP, secrets management, data discovery and classification, information rights management, retention and legal hold, logging of data events, and a new subdomain on protecting AI/ML data sets and models
3. Cloud Platform and Infrastructure Security	17%	Physical, network, compute, virtualization and storage components, the management plane, secure data center design, infrastructure risk analysis, security controls, and business continuity and disaster recovery
4. Cloud Application Security	16%	Secure SDLC, common cloud vulnerabilities (including the OWASP Top 10 for LLM applications and API Top 10), threat modeling, application security testing, supply chain and third-party software, containers and Kubernetes, and cloud IAM (federation, SSO, MFA, CASB)
5. Cloud Security Operations	17%	Building and operating physical and logical cloud infrastructure, hardening, patching, availability, ITSM processes, digital forensics, communication with stakeholders, and SOC operations including SIEM, incident response, vulnerability assessment and penetration testing
6. Legal, Risk and Compliance	13%	Conflicting international laws, eDiscovery and forensics standards, privacy laws (GDPR, HIPAA and others), audit reports (SOC, SSAE, ISAE), enterprise risk management, and cloud contracts, SLAs and vendor management

Domain names, weights and topics: ISC2 CCSP exam outline, effective August 1, 2026. Cloud Data Security is the heaviest domain at 20%, and the AI/ML material shows up in all six domains, well beyond the two new subdomains.

Experience, waivers and the Associate route

ISC2’s requirement, from the CCSP exam outline:

Five years of cumulative, full-time experience in information technology, of which three years must be in cybersecurity and one year in one or more of the six CCSP domains.
Waivers: A bachelor’s or master’s degree in computer science, IT or a related field can satisfy up to one year. Cloud Security Alliance’s CCSK certificate can substitute for one year. Only one year can be waived in total.
CISSP shortcut: An active CISSP substitutes for the entire CCSP experience requirement.
Part-time work and internships can count toward the requirement.
No experience yet? Pass the exam and become an Associate of ISC2. You then have six years to earn the five years of required experience. Associates pay a $50 annual fee and earn 15 CPE credits a year (ISC2).

Before ISC2 awards CCSP, you complete its endorsement application: an active ISC2-certified professional in good standing attests to your experience, or ISC2 can act as your endorser if you provide proof of employment. If you already have the experience, submit it within nine months of passing the exam.

Where engineers stumble

Legal, risk and compliance. Domain 6 covers privacy law, eDiscovery, audit report types, contracts and vendor risk. Engineers who skim it give away easy points.
Answering in one vendor’s dialect. The exam is vendor-neutral. If you reach for a specific AWS or Azure feature name, step back and think about the principle it implements.
Underweighting data security. Cloud Data Security is the heaviest domain at 20%: key management, tokenization versus masking, DLP, retention and legal hold.
Uneven prep. Adaptive testing punishes a weak domain. Consistency across all six matters more than acing two.

Ten weeks with a cloud console open

Assume about eight hours a week and some hands-on cloud time. Add extra time for domain 6; few engineers have done that work for a living.

Weeks 1 to 2: cloud concepts and architecture. NIST and ISO cloud definitions, roles, service and deployment models, the shared responsibility model and secure design principles. Read the August 2026 outline so you know what’s new.
Weeks 3 to 4: data security. The biggest domain. Data life cycle, encryption and key management, tokenization vs masking, DLP, classification, IRM, retention and legal hold. Add the new AI/ML data protection subdomain.
Week 5: platform and infrastructure. Virtualization and hypervisor security, the management plane, data center design, and BC/DR in the cloud (RTO, RPO).
Week 6: application security. Secure SDLC, threat modeling (STRIDE, PASTA), SAST vs DAST vs IAST vs SCA, API security, containers and Kubernetes, and federated identity.
Week 7: security operations. Hardening, patching, ITSM processes, SIEM and SOC work, forensics in the cloud, and incident response.
Week 8: legal, risk and compliance. Privacy laws, eDiscovery, audit report types, contracts and SLAs, and vendor risk. This domain trips up engineers, so give it a full week.
Weeks 9 to 10: practice. Timed practice tests and review by domain. Because CAT adapts to you, aim for consistent performance across all six domains rather than acing a few.

Cost, and the one-AMF rule

Exam: $599 in the Americas and most regions (EUR 575.04 in EMEA and GBP 485.19 in the UK), per ISC2’s pricing page. Moving your appointment costs $50; canceling costs $100. ISC2 also sells a two-attempt Peace of Mind Protection option.
Annual maintenance fee: $135 a year once certified. ISC2 charges one AMF no matter how many ISC2 certifications you hold, so a CISSP who adds CCSP still pays $135 in total (ISC2).
Associate route: $50 a year while you earn the experience, then an $85 upgrade when you become fully certified.
Training: Optional. ISC2 sells official self-paced and instructor-led courses; many candidates use the official study guide, a practice test bank and hands-on time in a cloud account.

What CCSP signals to employers

That you understand cloud security as architecture, operations and compliance, rather than as a list of console settings. It carries the most weight next to real experience on at least one major platform: the cert shows you know the principles, and the platform work shows you can apply them.

BLS doesn’t publish pay by certification. For the closest occupations, it reports May 2025 median pay of $129,180 for information security analysts, with 21% projected growth from 2025 to 2035 (BLS), and $134,050 for computer network architects (BLS).

CCSP versus CISSP, CISM, SecurityX and vendor certs

CCSP vs CISSP: CISSP is the broad, senior generalist certification; CCSP goes deep on cloud. They share an ISC2 membership and a single AMF, and an active CISSP covers the whole CCSP experience requirement, so CISSP then CCSP is a common sequence.
CCSP vs CISM: CISM is about running a security program and managing risk. CCSP is technical cloud security. Cloud-heavy security leaders often hold both.
CCSP vs SecurityX: SecurityX (formerly CASP+) is CompTIA’s hands-on advanced cert for security architects and engineers, and it includes cloud security, but it isn’t cloud-specific. CCSP is the cloud-focused choice.
CCSP vs vendor cloud security certs: Provider certifications, such as AWS Certified Security – Specialty, prove skill on one platform. CCSP is vendor-neutral and adds legal, risk and compliance. Many cloud security engineers hold one of each.

Building toward cloud security? The certification roadmap puts CCSP in context with the vendor certs.

Cloud misconfigurations make the news every week. Know which ones matter. Most cloud breach write-ups come down to identity, misconfiguration and shared responsibility, which is exactly what CCSP tests. The CyberExperts Daily Brief covers them in five minutes each weekday morning. Get tomorrow’s brief.

CCSP questions

Does my CISSP count toward CCSP?

Yes. An active CISSP satisfies the entire CCSP experience requirement. You still have to pass the CCSP exam, and ISC2 charges one $135 annual maintenance fee covering all your ISC2 certifications.

How is the CCSP exam delivered and scored?

Computerized Adaptive Testing with 100 to 150 items in three hours. You need 700 out of 1,000.

How much does CCSP cost?

$599 in the Americas and most regions. Once certified, you pay ISC2’s $135 annual maintenance fee.

What experience do I need for CCSP?

Five years of cumulative, full-time IT experience, including three years in cybersecurity and one year in one or more of the six CCSP domains. A relevant degree or the CCSK can waive one year (one year maximum), and an active CISSP covers the whole requirement.

Can I take CCSP without experience?

Yes. If you pass without the required experience, you can become an Associate of ISC2 and then have six years to earn the five years of experience.

What changed in the August 2026 outline?

The six domains stay, with weights of 17%, 20%, 17%, 16%, 17% and 13%. ISC2 revised subdomains throughout and added AI and machine learning topics, including new subdomains 1.6 (AI/ML concepts) and 2.9 (protecting AI/ML data).

CCSP or an AWS or Azure security cert?

A provider cert proves hands-on skill on one platform. CCSP is vendor-neutral and adds legal, risk and compliance. Many cloud security engineers hold one of each.

Sources

ISC2, CCSP certification: isc2.org
ISC2, CCSP exam outline (effective August 1, 2026): isc2.org
ISC2 Insights, ISC2’s CCSP exam outline revised (June 2026): isc2.org
ISC2, Exam pricing: isc2.org
ISC2, Annual maintenance fees FAQ: isc2.org
ISC2, Member policies (CPE requirements): isc2.org
ISC2, Associate of ISC2: isc2.org
ISC2, Endorsement: isc2.org
BLS, Information security analysts: bls.gov
BLS, Computer network architects: bls.gov

Donald Korinchak, MBA, PMP, CISSP, SecurityX, ITILv3

Donald Korinchak is a Cybersecurity Professional in the Washington DC area. Donald holds an MBA from the University of Pittsburgh Katz School of Business. Donald is considered a thought leader in business, leadership, and cybersecurity issues.