CCSP

What is on the ISC2 CCSP exam under the August 2026 outline?

2 October 2026Neil Marsden4 min read

CCSP exam under the outline effective 1 August 2026: six domain bars, Cloud Data Security 20% in gold, Concepts and Design 17%, Platform and Infrastructure 17%, Application Security 16%, Security Operations 17%, Legal, Risk and Compliance 13%. Adaptive, 100 to 150 items, 3 hours, 700 of 1000.

The ISC2 CCSP has changed twice in a year. It moved from a fixed-length exam to Computerized Adaptive Testing on 1 October 2025, and a new exam outline took effect on 1 August 2026. Today it is 100 to 150 items in up to 3 hours, with 700 of 1000 to pass, across six domains in which Cloud Data Security carries the most weight.

100 to 150Items

3 hrsMaximum

700To pass (of 1000)

6Domains

Every fact below comes from ISC2: the CCSP exam outline effective 1 August 2026, the Computerized Adaptive Testing FAQ, exam pricing and ISC2's member policies, all read on 2 October 2026.

Which CCSP domains carry the most weight?

Domain	Weight
1. Cloud Concepts, Architecture and Design	17%
2. Cloud Data Security	20%
3. Cloud Platform and Infrastructure Security	17%
4. Cloud Application Security	16%
5. Cloud Security Operations	17%
6. Legal, Risk and Compliance	13%

Want it on one page? Our free CCSP mind map gives the six domains with a mnemonic, and the 10-question CCSP quiz checks your recall in five minutes.

ISC2 announced on 30 June 2026 that for this outline "the domains and domain weights along with their subdomains have been revisited and revised." Five domains sit between 16% and 17%, so the exam is close to even, with Cloud Data Security a few points ahead and Legal, Risk and Compliance the lightest.

What is new on AI and machine learning?

The 2026 outline brings AI into two domains. Domain 1 has "1.6 Comprehend Artificial Intelligence (AI)/Machine Learning (ML)", including data source validation and verification, security orchestration, automation and response (SOAR), and ethical concerns. Domain 2 has "2.9 Comprehend data protection of Artificial Intelligence (AI) and Machine Learning (ML) data", including data set and model privacy. If your study material predates August 2026, it will not cover these.

How does the adaptive CCSP exam work?

ISC2 says "The CCSP exam uses Computerized Adaptive Testing (CAT) for all exams", since 1 October 2025. You see at least 100 items and at most 150, in up to 3 hours, and the exam ends when ISC2's model is confident of your result. As with the CISSP, item review is not permitted, so each answer you finalize is final. The exam is offered in English, Chinese, Japanese and German. At the full 150 items, 3 hours is 72 seconds an item.

CCSP study planner and checklist

ISC2 CCSP: study planner and exam-day checklist

Domain weights come from the CCSP Certification Exam Outline, effective 1 August 2026; rules from ISC2's outline page, Computerized Adaptive Testing FAQ, exam pricing and member policies, all read on 2 October 2026. ISC2 does not recommend a number of study hours; the budgets and the split are our suggestion, in proportion to the published weights.

Hours by domain

Domain	Weight	100 hours	150 hours	200 hours
1. Cloud Concepts, Architecture and Design	17%	17	25.5	34
2. Cloud Data Security	20%	20	30	40
3. Cloud Platform and Infrastructure Security	17%	17	25.5	34
4. Cloud Application Security	16%	16	24	32
5. Cloud Security Operations	17%	17	25.5	34
6. Legal, Risk and Compliance	13%	13	19.5	26
Total	100%	100	150	200

How the exam works (ISC2)

Computerized Adaptive Testing for all CCSP exams since 1 October 2025
100 to 150 items in up to 3 hours
700 out of 1000 to pass
Languages: English, Chinese, Japanese and German
No item review on an adaptive exam: once you finalize an answer, it is final

Pace for timed practice

Set	Items	Time at 150 items in 3 hours
One item	1	72 seconds
Short timed set	25	30 minutes
Maximum length	150	3 hours

Cost and upkeep

Exam: US$599 (EUR 575.04 in EMEA, GBP 485.19 in the UK)
Annual maintenance fee: US$135, one fee covering every ISC2 certification you hold
CPE: 90 credits per three-year cycle (60 in Group A)

Experience

Five years cumulative, full-time in IT; three in cybersecurity; one in one or more of the six CCSP domains
CSA's CCSK certificate can substitute for one year; only one year can be waived

# ISC2 CCSP: study planner and exam-day checklist

Domain weights come from the CCSP Certification Exam Outline, effective 1 August 2026; rules from ISC2's
outline page, Computerized Adaptive Testing FAQ, exam pricing and member policies, all read on
2 October 2026. ISC2 does not recommend a number of study hours; the budgets and the split are our
suggestion, in proportion to the published weights.

## Hours by domain

| Domain | Weight | 100 hours | 150 hours | 200 hours |
|---|---|---|---|---|
| 1. Cloud Concepts, Architecture and Design | 17% | 17 | 25.5 | 34 |
| 2. Cloud Data Security | 20% | 20 | 30 | 40 |
| 3. Cloud Platform and Infrastructure Security | 17% | 17 | 25.5 | 34 |
| 4. Cloud Application Security | 16% | 16 | 24 | 32 |
| 5. Cloud Security Operations | 17% | 17 | 25.5 | 34 |
| 6. Legal, Risk and Compliance | 13% | 13 | 19.5 | 26 |
| **Total** | **100%** | **100** | **150** | **200** |

## How the exam works (ISC2)

- [ ] Computerized Adaptive Testing for all CCSP exams since 1 October 2025
- [ ] 100 to 150 items in up to 3 hours
- [ ] 700 out of 1000 to pass
- [ ] Languages: English, Chinese, Japanese and German
- [ ] No item review on an adaptive exam: once you finalize an answer, it is final

## Pace for timed practice

| Set | Items | Time at 150 items in 3 hours |
|---|---|---|
| One item | 1 | 72 seconds |
| Short timed set | 25 | 30 minutes |
| Maximum length | 150 | 3 hours |

## Cost and upkeep

- [ ] Exam: US$599 (EUR 575.04 in EMEA, GBP 485.19 in the UK)
- [ ] Annual maintenance fee: US$135, one fee covering every ISC2 certification you hold
- [ ] CPE: 90 credits per three-year cycle (60 in Group A)

## Experience

- [ ] Five years cumulative, full-time in IT; three in cybersecurity; one in one or more of the six CCSP domains
- [ ] CSA's CCSK certificate can substitute for one year; only one year can be waived

What does the CCSP cost?

The exam is US$599 in most regions, EUR 575.04 in EMEA and GBP 485.19 in the UK. Once certified, you pay ISC2's annual maintenance fee of US$135, and members pay a single fee "regardless of how many certifications they earn", so a CISSP holder adds the CCSP at no extra yearly cost. You also need 90 continuing education credits over each three-year cycle, 60 of them in Group A. Our certification cost guide compares it with other credentials.

What experience do you need?

Five years of cumulative, full-time experience in information technology, of which three must be in cybersecurity and one in one or more of the six CCSP domains. The Cloud Security Alliance's CCSK certificate can substitute for one year, and only one year can be waived. ISC2 also says "An active CISSP credential may be substituted for the entire CCSP experience requirement." A candidate who passes without the experience can become an Associate of ISC2 and has up to six years to earn it.

CCSP or CISSP?

ISC2 aims the CCSP at "IT, cyber, information and software security leaders responsible for applying best practices to cloud security architecture, design, operations and service orchestration", and the CISSP at "experienced security practitioners, managers and executives" across eight domains. Because an active CISSP covers the whole CCSP experience requirement, the CISSP can come first. Our guides to the CISSP exam and the CISM or CISSP choice cover the neighbors.

How should you prepare?

Split your hours by the weights; the planner gives 100, 150 and 200-hour columns. The CCSP exam guide covers the outline effective 1 August 2026, including the AI topics in 1.6 and 2.9. Practice answering once without going back, because the adaptive exam will not let you.

What should you do this week?

Check that your study material follows the August 2026 outline, then start with Cloud Data Security, the largest domain. Credential Press is independent of ISC2, and nothing here comes from inside the exam.

Frequently asked questions

How many questions are on the CCSP exam?

Between 100 and 150 items in up to 3 hours. ISC2 moved the CCSP to Computerized Adaptive Testing on 1 October 2025, so the exam ends when its model is confident of the result or at the item or time limit.

What is the CCSP passing score?

700 out of 1000 points, on ISC2's CCSP outline page.

What changed in the August 2026 CCSP outline?

ISC2 says the domains, domain weights and subdomains were revisited and revised for the outline in place from 1 August 2026. Cloud Data Security is now the largest domain at 20%, and the outline adds AI and machine learning topics, including data protection for AI and ML data.

How much does the CCSP exam cost?

US$599 in most regions, EUR 575.04 in EMEA and GBP 485.19 in the UK, on ISC2's pricing page, read 2 October 2026.

What experience does the CCSP need?

Five years of cumulative, full-time IT experience, three of them in cybersecurity and one in one or more of the six CCSP domains. Cloud Security Alliance's CCSK certificate can substitute for one year, and an active CISSP can substitute for the entire requirement.

Do I pay a separate fee for the CCSP if I hold the CISSP?

No. ISC2 charges members a single annual maintenance fee of US$135 however many ISC2 certifications they hold.

CCSP: test yourself in five minutes