The CCSP exam domains divide cloud security into six weighted areas, and understanding how those percentages split is the single most practical fact for deciding where to spend preparation time. The ISC2 Certified Cloud Security Professional credential tests a candidate across architecture, data protection, infrastructure hardening, application security, operations, and legal compliance, and a mid-2026 outline revision has refreshed what each domain covers. This guide maps every domain, its share of the exam, the eligibility bar, and a study-priority order that follows the weights rather than personal preference.
What the CCSP Exam Covers
The CCSP exam weights its six domains unevenly, with Cloud Data Security carrying the highest weight at 19 percent and Legal, Risk and Compliance the lowest at 14 percent. Because the exam uses a single composite scaled score with no per-domain minimum, a weak performance in a high-weight domain is harder to offset, which is why data security deserves the largest block of study time. The table below shows the current distribution that ISC2 publishes in its official exam outline.
| Domain | Weight | Primary focus |
|---|---|---|
| 1. Cloud Concepts, Architecture and Design | 17% | Service models, deployment models, shared responsibility |
| 2. Cloud Data Security | 19% | Data lifecycle, encryption, key management, classification |
| 3. Cloud Platform and Infrastructure Security | 17% | Virtualization, network segmentation, disaster recovery |
| 4. Cloud Application Security | 17% | Secure SDLC, IAM federation, API security, DevSecOps |
| 5. Cloud Security Operations | 16% | Monitoring, incident response, change management |
| 6. Legal, Risk and Compliance | 14% | Privacy law, audit frameworks, contracts, risk treatment |
The CCSP exam delivers 150 multiple-choice items over a four-hour window and sets the passing score at 700 out of a possible 1000. There are no drag-and-drop or performance-based tasks; the challenge is sustaining accurate judgement across a long run of scenario questions that describe imperfect business situations. Shared responsibility, data ownership, and the split between provider and customer controls surface across multiple domains, so candidates who internalize those boundaries early gain a lasting advantage on every later question.
The 2026 Outline Revision
ISC2 revised the CCSP exam outline in mid-2026, revisiting every domain, its weight, and its subdomain structure. The revision was announced through ISC2’s official insights channel and reflects the reality that cloud technologies now dominate the modern software supply chain, securing distributed assets, sensitive data, and dynamic user environments. A new version of the outline becomes effective August 1, 2026, meaning candidates who test before that date sit the current blueprint while later candidates face the refreshed content and updated subdomains.
The practical takeaway is to confirm the active outline before booking a slot. ISC2 recommends that every candidate review the exam policies and the current outline on its certification page, because the domains and their weights can shift over the lifetime of the credential. If study materials predate the revision, cross-check each domain heading and weighting against the official source rather than assuming an older guide still matches the tested scope. Emerging areas flagged for the new outline include AI and machine-learning workload security, container orchestration, serverless patterns, and refreshed regulatory content.
Experience and Eligibility
Full CCSP certification calls for five years of cumulative paid IT experience, including three years in information security and one year in at least one of the six CCSP domains. Holding an active CISSP satisfies the entire experience requirement, which makes CCSP a natural next credential for security professionals moving deeper into cloud architecture and governance. Candidates who pass the exam before meeting the experience bar can earn the Associate of ISC2 designation and then work toward full certification, a route that keeps newer practitioners from waiting years before they can begin testing.
Eligibility is not merely a gatekeeping step; it reflects how the exam is designed. CCSP rewards cloud security judgement rather than memorized definitions, so hands-on exposure to identity configuration, key management, audit logging, and control mapping makes a measurable difference in scenario questions. Documenting job titles, dates, responsibilities, and cloud-related work while it is current also smooths the endorsement process. For help placing CCSP inside a broader career trajectory, our IT certification strategy guide compares it against adjacent credentials organized by target role.
Study Priorities by Weight
The most efficient plan allocates time in proportion to domain weight, not in proportion to what a candidate already enjoys studying. Cloud Data Security at 19 percent deserves roughly a fifth of structured study hours, with focused attention on the data lifecycle, encryption and key management, tokenization, data classification, retention rules, and crypto-shredding. Domains 1, 3, and 4 each carry 17 percent and should receive equal footing, while the 14-percent legal domain must not be skipped simply because it looks small on paper.
- Download the current ISC2 CCSP Exam Outline and rate yourself strong, adequate, or weak in each domain.
- Front-load Cloud Data Security, then rotate through the three 17-percent domains in parallel.
- Reserve dedicated time for Legal, Risk and Compliance, where technically strong candidates most often lose marks.
- Run timed, full-length practice sets to build stamina for the four-hour session.
- Review every wrong answer, map it back to a domain, and note why the correct option was stronger.
Provider-neutral preparation consistently outperforms single-cloud study. A candidate may work mainly in AWS, Azure, or Google Cloud, but the exam tests security principles that recur across service models rather than vendor service-name recall. Short labs that reveal how a control behaves — configuring least-privilege identity, inspecting key access, enabling and reading logs, comparing segmentation models across platforms — add more value than lengthy configuration sessions in one console. The Cloud Security Alliance guidance and Cloud Controls Matrix are useful for translating cloud technology into governance and audit language. For a sense of how security credentials translate into salary outcomes, see our analysis of whether CompTIA Security+ is worth it in 2026, which applies the same return-on-investment lens to an entry-level counterpart.
Sources
- ISC2 CCSP Certification Exam Outline — official domain weights and examination structure.
- ISC2 Refreshes CCSP Exam — announcement of the 2026 outline revision and refreshed domain weights.
- CCSP Domains Explained (ccsp.app) — per-domain weights, approximate question counts, and the August 2026 effective date.
- Top Tips to Pass the ISC2 CCSP Certification Exam (Readynez) — exam mechanics, eligibility requirements, and preparation strategy.