ISC2 CCSP Certification

The CCSP, Certified Cloud Security Professional, is ISC2’s flagship cloud security credential. It validates that you can secure data, applications, and infrastructure running in someone else’s data center, where you control the configuration but not the concrete. Rather than testing which console button to click, it tests whether you understand shared responsibility, data sovereignty, cryptographic custody, and the legal machinery that follows data across borders.

Since October 1, 2025 the CCSP has been delivered as a Computerized Adaptive Test, so the question count varies between 100 and 150. The exam adjusts item difficulty to your performance as you go, and there is no going back to review earlier answers.

ISC2 scores the live CCSP on a scale of 1000, with 700 required to pass. Because that is a scaled score rather than a raw percentage, Certifym sets the pass mark on its practice exam at 70% as the honest raw-score equivalent.

The exam runs three hours and is delivered in person at Pearson VUE test centers. It is available in English, Chinese, Japanese, and German.

ISC2 asks for five years of cumulative IT experience, of which three years must be in cybersecurity and one year in one or more of the six CCSP domains. Holding a CISSP in good standing waives the experience requirement entirely.

It is a demanding exam that rewards judgment over recall. Most candidates arrive with CISSP-level security experience and real cloud scars, and the item writing reflects that: distractors are defensible rather than dismissible, and most questions ask for the best answer among several plausible ones. The adaptive format adds pressure, since you cannot return to an earlier question once you have answered it.

Six domains: Cloud Concepts, Architecture and Design (17%), Cloud Data Security (20%), Cloud Platform and Infrastructure Security (17%), Cloud Application Security (16%), Cloud Security Operations (17%), and Legal, Risk and Compliance (13%). Those are the weights of the outline in force since August 1, 2026. Cloud Data Security is the heaviest and, for most candidates, the hardest; if you over-prepare only one domain, make it that one.

ISC2 moved the CCSP to a refreshed exam outline drawn from its latest Job Task Analysis. The six domains kept their names, AI/ML security coverage was folded into them (comprehending AI/ML in Domain 1, protecting training data and models in Domain 2), and the weights shifted by a single point: Cloud Application Security from 17% to 16% and Cloud Security Operations from 16% to 17%. Format, length, passing score, and experience requirements did not change. The outline above is the current one; the official PDF is on isc2.org.

Work the domains in proportion to their weights and drill scenarios rather than definitions, because the exam is built around best-answer judgment. Certifym’s practice exam mirrors the live experience where it matters: 125 scenario-driven questions weighted to the official six-domain blueprint, a three-hour clock, and explanations that tell you why the winning answer beats the near-miss. Always confirm the current outline and logistics at isc2.org before you schedule.

The CISSP is ISC2’s broad information security credential; the CCSP narrows the lens to cloud, shared responsibility, data sovereignty, cryptographic custody, and cross-border legal exposure. The two are closely linked in practice: most CCSP candidates arrive with CISSP-level security experience, and a CISSP in good standing waives the CCSP’s five-year experience requirement outright.