CCSP
Cloud security as a specialism: who the CCSP is for
Moving to the cloud does not move responsibility for security to the provider. It splits it, and the split changes with every service model. The CCSP is ISC2's credential for people who work inside that split: ISC2 says it demonstrates the advanced technical skills and knowledge to design, manage and secure data, applications and infrastructure in the cloud. This guide is about who it suits, how shared responsibility works by service model, what the exam weights, and what it takes to earn and keep.
The facts here come from ISC2's CCSP Exam Outline, effective 1 August 2026, its CCSP and experience requirements pages, read on 20 October 2026, NIST's definition of cloud computing, and our CCSP Exam Guide. Where this page and ISC2 differ, ISC2 wins.
What does the CCSP measure?
ISC2's outline divides cloud security into six domains and publishes the weight of each:
| Domain | Weight | What it covers, in brief |
|---|---|---|
| 1. Cloud Concepts, Architecture and Design | 17% | Cloud concepts and reference architecture, security basics, secure cloud design, evaluating providers, AI and machine learning |
| 2. Cloud Data Security | 20% | Cloud data concepts, storage, data discovery, classification, retention and accountability |
| 3. Cloud Platform and Infrastructure Security | 17% | Cloud infrastructure, data center design, risk, infrastructure security controls, business continuity |
| 4. Cloud Application Security | 16% | Secure software development and assurance, cloud application architecture, identity management |
| 5. Cloud Security Operations | 17% | Building and operating cloud infrastructure, operational controls, forensics, security operations |
| 6. Legal, Risk and Compliance | 13% | Legal requirements, privacy, cloud audit, enterprise risk management, cloud contracts |
The weights are nearly flat, from 13% to 20%, and data security is the heaviest. That is the right emphasis. In every cloud service model the data stays the customer's responsibility, so the domain that covers how data is discovered, classified, stored, retained and accounted for is the one that never moves to the provider. The outline's sixth domain, on law, risk and contracts, is a reminder that cloud security is also a legal and commercial question: where the data lives, what the contract says, and what an auditor can see.
The 2026 outline also puts AI and machine learning inside the first domain, alongside secure cloud design and provider evaluation. A cloud security professional is now expected to know what AI workloads change.
The six domains, in practice
Each domain has a recognizable job inside it. The data domain is about knowing what data you hold and how sensitive it is: data classification is the process of assigning a sensitivity level to information based on its value and risk to the organization, and the roles around it matter as much as the labels. A data owner is a senior executive accountable for the protection, classification and authorized use of a data set; a data custodian is the IT professional who implements the technical controls the owner specifies. Shadow IT, cloud services used without the IT department's approval or knowledge, is the domain's most common source of data nobody classified.
The platform and infrastructure domain covers what sits underneath: data centers, software-defined networking, which separates the control plane from the data forwarding plane, and virtual private clouds, logically isolated sections of a public cloud where a tenant deploys resources. It also covers physical security and business continuity, because a cloud provider's data center still needs perimeter controls, power resilience and recovery plans, and a customer still needs to know how its own services recover.
The application domain covers secure development and cloud application architecture. In a microservice design, every service-to-service call is a network call an attacker might intercept, and server-side request forgery, where an attacker makes a server send a request to an unintended destination, is one of the vulnerabilities the domain covers. Web application firewalls, API gateways and input validation are the controls the domain expects candidates to place correctly. Identity management sits here too, because in the cloud identity is the main perimeter.
The operations domain covers building and running cloud infrastructure, including the hardware that protects keys: a Trusted Platform Module stores cryptographic keys specific to a host, while a hardware security module safeguards and manages keys for strong authentication. The legal domain covers frameworks, jurisdiction and data localization, the legal requirement that data created within a border stay within it, along with privacy, cloud audit, enterprise risk management and contracts.
Shared responsibility, by service model
NIST's definition of cloud computing, Special Publication 800-145, sets out the service models the CCSP builds on: infrastructure, platform and software as a service. Our guide teaches the shared responsibility split for each, and its rule for the exam is blunt: when a question asks who is responsible for data classification or IAM policies in a SaaS environment, the answer is always the customer.
| Service model | The provider runs | The customer keeps | CCSP domains |
|---|---|---|---|
| IaaS | The physical infrastructure underneath | The guest operating system, middleware, runtime environment, application code and data | 3 platform and infrastructure; 4 application; 2 data |
| PaaS | A managed environment, including the underlying operating system | The applications built and deployed on it, and the data | 4 application; 2 data |
| SaaS | A complete application, hosted and managed | Data classification and identity and access policies, always | 2 data; 4 identity management |
| Every model | What the contract says it runs | The data, its classification, who can access it, and the contract terms that protect it | 2 data; 6 legal, risk and compliance |
The last row is the one that matters most and the one most often forgotten. Our guide warns not to let the simplicity of SaaS trick you into abdicating your security responsibilities. A SaaS application can be secure and the customer's use of it can still be careless: overshared folders, stale accounts, data that should never have been uploaded. That half of the split is the customer's, and so is the CCSP holder's job.
Risk language helps here. Our guide distinguishes risk appetite, the amount of uncertainty an organization is willing to accept in pursuit of its goals, from the risk profile, the actual current level and distribution of risk across the organization. A cloud estate where nobody has written down the customer's half of the split has a risk profile nobody can see, whatever the appetite says. The worksheet is the first step to making it visible.
A team can use the worksheet in a single session per service: architecture, security, the service owner and procurement in the room, the contract on the screen, and one question for each line, who owns this today? The gaps it finds are usually not technical. They are controls everyone assumed the provider or another team was running.
We have turned the table into a worksheet you can fill in for each cloud service an organization uses, which you can copy or download below.
Cloud shared responsibility worksheet
Who is the CCSP for?
ISC2 says the CCSP is ideal for IT, cyber, information and software security leaders responsible for applying best practices to cloud security architecture, design, operations and service orchestration, and lists the positions it has in mind. Read against the domains, they look like this:
| Position ISC2 lists | Cloud security work | CCSP domains that carry the day job | Pairs it with |
|---|---|---|---|
| Cloud architect | Designing secure cloud environments and choosing providers | 1, then 3 | CISSP |
| Cloud engineer or administrator | Building and operating cloud infrastructure | 3 and 5 | A provider's own certifications |
| Cloud security analyst | Monitoring, incident response, forensics in the cloud | 5, then 2 | CISSP |
| Professional cloud developer | Secure development and application architecture | 4 | A secure development credential |
| Cloud consultant or specialist | Cloud strategy, migrations and reviews for clients | 1 and 6 | CISSP or CCSK |
| Auditor of cloud computing services | Assessing cloud controls, contracts and evidence | 6, then 2 | CISA |
The pairings are our suggestion, not ISC2's. The CCSP is vendor-neutral by design, so it pairs naturally with a provider's own certifications for people who work mainly in one cloud: the CCSP gives the principles, the provider certification gives the tools.
What ISC2 says about recognition
ISC2's CCSP page describes the credential as ANAB accredited to ISO/IEC 17024 and approved under the US Department of Defense's DoDM 8140.03. For people working on US defense contracts, that approval can matter as much as the content. Check the current DoD qualification requirements for your specific work role.
When does the CCSP start to matter?
Cloud security becomes a specialism at a few predictable moments.
The organization migrates
A migration moves systems into a new responsibility model. Every control that the data center provided implicitly now has to be designed, configured or contracted for. The architecture domain covers secure cloud design and provider evaluation, and the CCSP holder is the person who asks, before the move, who will own each control afterwards.
A regulator looks at cloud reliance
In the EU, DORA includes rules on ICT third-party risk, and NIS2 includes supply chain security among its measures. NIS2's Article 21(2) lists supply chain security, including relationships with direct suppliers and service providers, among its minimum measures. For some organizations, the cloud provider is the most important service provider of all, and someone has to assess it and manage the contract.
Data has to stay in a jurisdiction
Where data is stored and processed is a cloud architecture choice and a legal one. The GDPR restricts transfers of personal data out of the EEA, and contracts, sector rules and customer demands add their own location requirements. The legal domain covers legal requirements, privacy and cloud contracts, and the data domain covers storage and retention.
Something goes wrong in the cloud
Cloud forensics is different because the investigator rarely controls the hardware. Our guide stresses evidence handling: a chain of custody is a chronological record of who collected, handled and transferred evidence, and when a question asks for the FIRST action after a suspected compromise of a cloud instance, capturing a snapshot can be the only correct answer. eDiscovery, the process of identifying, collecting and producing electronically stored information for a lawsuit or investigation, is a different task with different rules, and the exam expects you to know the difference.
A provider is chosen
Provider evaluation is part of the first domain, and it is where cloud security starts. Before a contract is signed, the customer has to know what the provider runs, what evidence it will share about its controls, where data will be stored and processed, how incidents will be reported, and what happens to the data at the end. The legal domain's cloud contracts topic covers the same ground from the other side: the terms that turn those answers into obligations.
A contract ends
Leaving a provider raises the question of what happens to the data left behind. When the customer cannot physically destroy the provider's media, crypto-shredding, destroying the encryption keys so the data can no longer be read, is the answer our guide marks as BEST. Exit terms belong in the contract before the first byte is uploaded.
Where does the credential apply?
The CCSP is global and vendor-neutral. ISC2 offers the exam in English, Chinese, Japanese and German, and its content is built on general cloud concepts rather than any one provider's services. The legal domain covers legal requirements, privacy and audit in general terms; the specific rules, such as DORA, NIS2 or the GDPR in Europe, apply on top according to where an organization operates.
That neutrality is deliberate, and our guide treats it as a strength. A CCSP holder can move between providers, or work across several at once, because the exam teaches what every provider has to answer: who runs which layer, where the data is, how it is protected, and what the contract says.
What the CCSP is not
It is not a provider certification. It will not teach you one provider's console or services. It teaches the security concepts behind all of them.
It is not an entry credential. The experience rule asks for five years of IT experience, three of them in cybersecurity and one in the CCSP domains. The Associate route lets you pass first and earn the experience over six years.
It is not 70%. The pass mark is 700 out of 1000, and ISC2 does not publish the raw-to-scaled conversion, so the number says nothing about what share of the items you need to answer correctly.
It is not only technical. Legal, risk and compliance is 13% of the exam. Contracts, audits and data location are part of cloud security.
From exam to certification: ISC2's rules
| Step | ISC2's rule |
|---|---|
| Exam | US$599 in most regions, EUR 575.04 in EMEA, GBP 485.19 in the UK |
| Format | 100 to 150 items, multiple choice and advanced item types, 3 hours; English, Chinese, Japanese, German |
| Pass | 700 out of 1000 |
| Experience | Five years cumulative, full-time in IT: three in cybersecurity, and one in one or more of the six CCSP domains |
| Waivers | A relevant degree, or CSA's CCSK certificate, can cover one year; only one year can be waived |
| CISSP holders | An active CISSP substitutes for the entire experience requirement |
| Without the experience | Become an Associate of ISC2, with six years to earn the five years |
| Part-time and internships | Part-time at 20 to 34 hours a week counts (2,080 part-time hours make 12 months); internships can count |
| Keep it | US$135 annual maintenance fee and ISC2's CPE requirements |
The CISSP substitution is the detail that shapes most CCSP careers. Because an active CISSP covers the whole experience requirement, one path is to earn the CISSP for breadth and then the CCSP for cloud depth. For someone without the CISSP, the three-years-in-cybersecurity part of the rule is worth checking first.
How does it compare with the credentials around it?
| CCSP | CISSP | CDPSE | |
|---|---|---|---|
| Awarded by | ISC2 | ISC2 | ISACA |
| Scope | Cloud security across six domains | Security across eight domains | Privacy engineering, including cloud technology stacks |
| Exam | 100 to 150 items, 3 hours, 700 of 1000 | 100 to 150 items, adaptive, 3 hours, 700 of 1000 | 120 questions, 3.5 hours, 450 on 200 to 800 |
| Experience | 5 years IT, 3 in cybersecurity, 1 in a CCSP domain; CISSP covers it all | 5 years in 2 or more of 8 domains | 3 years across the four domains; no waivers |
The CISSP is the broad base; the CCSP is the cloud specialism on top of it. The CDPSE comes at cloud from the privacy side, through its technology stacks topics. Our CISSP exam page and the CCSP exam page have the full outlines.
What will the exam expect of you?
The CCSP has 100 to 150 items in three hours, multiple choice and advanced item types. As with all ISC2 exams, qualifiers decide many questions, and FIRST is one our guide returns to often. Defining the scope is the FIRST action in an assessment; gathering business requirements is the FIRST action in a design; and candidates who reach for a technical control such as Information Rights Management when a question asks for the FIRST step in securing unstructured data have skipped the step before it.
The other pattern is responsibility. Questions that describe a cloud incident or a design often turn on who owns the layer in question, and the answer depends on the service model. If you cannot say who runs the operating system in PaaS, or who owns access policies in SaaS, you will lose marks across several domains. Test yourself with the CCSP quiz, see the domains on one page in the CCSP mind map, and if the credential is part of a job move, the CCSP interview questions page covers what employers ask.
How to prepare
Start from the exam outline, which ISC2 publishes free, and plan against the weights. With weights this even, the risk is skipping a domain, not under-preparing a big one. If you plan 100 hours, give about 20 to cloud data security and 13 to 17 to each of the others, then move hours toward what your job does not touch: an infrastructure engineer may need more time on law and contracts, an auditor more on platform and operations.
The CCSP Exam Guide (Wikidata) has 12 chapters across 397 pages. Every chapter maps to a published domain, the weight is printed at the head of each domain, and the chapters are sized to it. It is vendor-neutral, on purpose, and every source is named at the back.
The CCSP Practice Questions (Wikidata) has 211 questions weighted to the published domain weights, with a full rationale for each and the answer letters spread on purpose.
Work from your own environment as you study. For each domain, ask how it applies to one cloud service you know: what data is in it and who owns it, which layers the provider runs, how the application is built and exposed, how it is monitored, and what the contract says. The answers you cannot give are the parts of the outline to study first.
Is it current? Both books follow the CCSP Exam Outline effective 1 August 2026. Check ISC2's CCSP page for any newer outline before you book.
So, do you need the CCSP?
Take it if cloud is where your security work happens: as a cloud architect, engineer, security analyst, developer, consultant or auditor of cloud services. It is ISC2's credential for the specialism, it is vendor-neutral, and it covers the legal and contractual side of cloud as well as the technical one. Take it especially if you already hold the CISSP, because your experience requirement is already met.
It also suits security professionals whose estate has moved to the cloud around them. A security analyst whose logs now come from cloud services, or an auditor whose clients run on someone else's infrastructure, needs the cloud responsibility model and the cloud-specific controls, and the CCSP is built to teach both.
Look elsewhere if you work in one provider's ecosystem and need its tools more than the principles; that provider's certifications will serve you sooner. And if you are early in a security career, the CISSP or a foundation credential may come first, with the CCSP once cloud becomes your specialism.
Questions people ask about the CCSP
Who is the CCSP for?
ISC2 says it is ideal for IT, cyber, information and software security leaders responsible for applying best practices to cloud security architecture, design, operations and service orchestration, and lists positions including cloud architect, cloud engineer, cloud consultant, cloud administrator, cloud security analyst, cloud specialist, auditor of cloud computing services and professional cloud developer.
What experience do I need for the CCSP?
Five years of cumulative, full-time experience in IT, of which three must be in cybersecurity and one in one or more of the six CCSP domains. A relevant degree or CSA's CCSK certificate can each cover one year, but only one year can be waived. An active CISSP substitutes for the entire experience requirement.
Can I take the CCSP without the experience?
Yes. If you pass without it, you can become an Associate of ISC2, with six years to earn the five years of experience.
How long is the CCSP exam?
Three hours for 100 to 150 items, multiple choice and advanced item types. ISC2 offers it in English, Chinese, Japanese and German.
What is the CCSP passing score?
700 out of 1000. ISC2 does not publish the conversion from raw answers, so 700 is not 70% of the questions.
How much does the CCSP cost?
ISC2 lists the exam at US$599 in most regions, EUR 575.04 in EMEA and GBP 485.19 in the UK, with an annual maintenance fee of US$135 after certification.
CCSP or CISSP?
The CISSP covers security across eight domains; the CCSP specializes in cloud. An active CISSP covers the CCSP's whole experience requirement, so some people take the CISSP first and add the CCSP for cloud depth.
Is the CCSP tied to one cloud provider?
No. It is vendor-neutral. It teaches cloud security concepts, architecture and controls that apply across providers, rather than one provider's tools.
Who is responsible for security in the cloud?
It depends on the service model, but some things never move. Whatever the model, the customer remains responsible for its data, how it is classified and who can access it. In IaaS the customer also owns the guest operating system, middleware, runtime and application code.
Is the CCSP recognized by the US Department of Defense?
ISC2's CCSP page describes the CCSP as approved under DoDM 8140.03 and accredited to ISO/IEC 17024 by ANAB.
CCSP: test yourself in five minutes
Which books prepare you for the CCSP exam?
Certified Cloud Security Professional. 12 chapters, 397 pages.
Practice questions with full rationales, sized to the published domain weights. 227 pages.
How to credit this page
Using a figure or a passage from this page in an article, a course, a forum answer or AI-generated text? Please credit Credential Press and link to this page, so your readers can check the source and the date it was reviewed. Copy a ready-made citation:
Plain text
Markdown
HTML
Sources
- ISC2, CCSP Exam Outline, effective 1 August 2026
- ISC2, CCSP Certification: who it is for, listed positions, accreditation and DoD approval
- ISC2, CCSP Experience Requirements: waivers, CISSP substitution, Associate route
- NIST, SP 800-145, The NIST Definition of Cloud Computing
- Regulation (EU) 2022/2554 (DORA)
- Directive (EU) 2022/2555 (NIS2), Article 21
- Regulation (EU) 2016/679 (GDPR)
- ISC2, CISSP Exam Outline, effective 15 April 2024
Credential Press is not affiliated with, endorsed by or authorized by ISC2, the Cloud Security Alliance or ISACA. CCSP and CISSP are trademarks of ISC2; CCSK is a trademark of the Cloud Security Alliance; CDPSE is a trademark of ISACA.