You can see it againUnder pressure people bring back shapes and positions long after the wording has gone.
Picture superiority · Shepard 1967, Standing 1973
ISC2Certified Cloud Security Professional
The Certified Cloud Security Professional (CCSP) certification validates your advanced technical skills to design, manage, and secure data, applications, and infrastructure in the cloud. It is ideal for experienced IT and cybersecurity professionals responsible for cloud security architecture, operations, and compliance. Earning the CCSP demonstrates you can apply best practices and policies established by ISC2's global community of cybersecurity experts to protect critical assets in the cloud.
Exam formatMultiple choice and advanced item types
Duration180 minutes
DeliveryPearson VUE
Passing score700 out of 1000 points
Free questions1030
Content last reviewed 30 July 2026 · Up to date
The certification
What Certified Cloud Security Professional proves, and what it asks of you
What this certification covers, who it is written for, and what the exam itself looks like on the day.
6domains
38objectives
310concepts
US $599exam fee
What it is
What this certification is
What it validates, who it is written for, and the experience it assumes.
About this certification
The Certified Cloud Security Professional (CCSP) certification from ISC2 is a globally recognized credential that proves you have the advanced technical skills and knowledge to design, manage, and secure data, applications, and infrastructure in the cloud. It is built on a comprehensive body of knowledge that covers cloud concepts, architecture, data security, platform and infrastructure security, application security, operations, and legal, risk, and compliance. The CCSP demonstrates your ability to apply best practices, policies, and procedures established by ISC2's certified members and cybersecurity experts around the globe.
Earning the CCSP validates your competence in cloud security design, implementation, architecture, operations, controls, and compliance with regulatory frameworks. It is designed for experienced professionals who apply information security expertise to cloud computing environments and demonstrates your ability to secure complex cloud environments and lead cloud security initiatives. As a CCSP, you join a community of cybersecurity leaders and gain access to ongoing professional development and networking opportunities.
Who it’s for
The CCSP is ideal for IT, cyber, information, and software security leaders responsible for applying best practices to cloud security architecture, design, operations, and service orchestration. This includes professionals in roles such as Cloud Architect, Cloud Engineer, Cloud Consultant, Cloud Administrator, Cloud Security Analyst, Cloud Specialist, Auditor of Cloud Computing Services, and Professional Cloud Developer. If you are an experienced security practitioner looking to demonstrate your expertise in cloud security and advance your career, the CCSP is designed for you. It is also suitable for professionals who want to validate their skills in securing cloud environments and gain a globally recognized credential that is respected by employers across industries.
Recommended experience
A minimum of five years of cumulative, full-time IT experience, including three years in cybersecurity and one year in one or more of the six CCSP domains. A bachelor's or master's degree in computer science, IT, or a related field may waive up to one year of experience, and the CSA's CCSK certificate can substitute for one year. An active CISSP credential waives the entire experience requirement. Five years cumulative, full-time IT experience; Three years of cybersecurity experience; One year in one or more of the six CCSP domains; A post-secondary degree (bachelors or masters) in computer science, IT, or related fields may satisfy up to one year of experience; CSA's CCSK certificate can substitute for one year of experience; Part-time work and internships may count towards the experience requirement
The syllabus
What you’ll learn
Every domain and objective ISC2 measures, with the weight they carry on the exam.
The official ISC2 exam outline · checked 30 July 2026 · See the source
Cloud Concepts, Architecture and Design
- Understand cloud computing concepts
- Describe cloud reference architecture
- Understand security concepts relevant to cloud computing
- Understand design principles of secure cloud computing
- Evaluate Cloud Service Providers (CSP)
- Comprehend Artificial Intelligence (AI)/Machine Learning (ML)
Cloud Data Security
- Describe cloud data concepts
- Design and implement cloud data storage architectures
- Design and apply data security technologies and strategies
- Implement data discovery
- Plan and implement data classification
- Design and implement Information Rights Management (IRM)
- Plan and implement data retention, deletion, and archiving policies
- Design and implement auditability, traceability, and accountability of data events
- Comprehend data protection of Artificial Intelligence (AI) and Machine Learning (ML) data
Cloud Platform and Infrastructure Security
- Comprehend cloud infrastructure and platform components
- Design a secure data center
- Analyze risks associated with cloud infrastructure and platforms
- Plan and implementation of security controls
- Plan business continuity (BC) and disaster recovery (DR)
Cloud Application Security
- Advocate training and awareness for application security
- Describe the Secure Software Development Life Cycle (SDLC) process
- Apply the Secure Software Development Life Cycle (SDLC)
- Apply cloud software assurance and validation
- Use verified secure software
- Comprehend and apply the specifics of cloud application architecture
- Design appropriate Identity and Access Management (IAM) solutions
Cloud Security Operations
- Build and implement physical and logical infrastructure for cloud environment
- Operate and maintain physical and logical infrastructure for cloud environment
- Implement operational controls and standards (e.g., National Institute Of Standards And Technology (NIST), International Organization For Standardization (ISO), Health Insurance Portability and Accountability Act (HIPPA), Control Objectives For Information And Related Technology (COBIT), Center For Internet Security (CIS) Controls, Comittee Of Sponsoring Organizations (COSO), Information Technology Infrastructure Library (ITIL) International Organization For Standardization/International Electrotechnical Commission (ISO/IEC) 20000-1)
- Support digital forensics
- Manage communication with relevant parties
- Manage security operations
Legal, Risk and Compliance
- Articulate legal requirements and unique risks within the cloud environment
- Understand privacy issues
- Understand audit process, methodologies, and required adaptations for a cloud environment
- Understand implications of cloud to enterprise risk management
- Understand outsourcing and cloud contract design
On the day
The exam itself
Everything ISC2 publishes about sitting it, and nothing we inferred.
Prerequisites
Minimum of five years cumulative, full-time IT experience, including three years in cybersecurity and one year in one or more of the six CCSP domains.
CertificationCertified Cloud Security Professional
Exam formatMultiple choice and advanced item types
Duration180 minutes
Questions100–150 questions
Passing score700 out of 1000 points
DeliveryPearson VUE
LanguagesEnglish, Chinese, Japanese, German
PricingUS $599
Certification levelProfessional
After you pass
Where this credential goes next
The path ISC2 lays out, how the credential is kept, and where to book.
Step-by-step path to Certified Cloud Security Professional
PrerequisiteMinimum of five years cumulative, full-time IT experience, including three years in cybersecurity and one year in one or more of the six CCSP domains.
Credential earnedCertified Cloud Security Professional Professional level certification Renewal and maintenance
CCSP certification is valid for three years and must be renewed by earning continuing professional education (CPE) credits and paying an annual maintenance fee (AMF). Stay current with the latest technologies and maintain your certification.
Learn more about renewal requirements Lifecycle status
This certification is currently active and available. ISC2 maintains this certification to validate current skills and industry relevance.
Exam status: ActiveMaintained by ISC2
Exam registration
Register for the exam through Pearson VUE, ISC2’s authorized testing partner.
Schedule your examVisit the official ISC2 certification page for exam policies and requirements.
View the official pageYour coach
And when you are serious, your coach Pip takes over
Your coach in the app reads what you have answered with the book closed and tells you one thing to do tonight. It will not count an answer you gave with the page open, and it will tell you when you are not ready.
See how the coach worksBefore you book
Questions people ask
How does the CCSP relate to the CISSP certification?
An active CISSP credential can be substituted for the entire CCSP experience requirement, making it a common pathway for CISSP holders to earn the CCSP.
Is there a new CCSP exam outline coming?
Yes, a new CCSP exam outline becomes effective August 1, 2026. Candidates should review the latest outline to ensure their study plan aligns with the updated domains and topics.
Can I take the CCSP exam before meeting the experience requirement?
Yes, you can take the exam and become an Associate of ISC2 if you pass but do not yet have the required experience. You will have six years to earn the five years of required experience.
What is the retake policy for the CCSP exam?
ISC2 exam retake policies apply. Candidates who purchase the exam with Peace of Mind Protection receive two exam attempts with a 30-day waiting period between attempts.
Are there any hands-on or lab components in the CCSP exam?
The CCSP exam uses Computerized Adaptive Testing (CAT) and consists of multiple choice and advanced item types. There is no hands-on lab component.
What job roles does the CCSP certification map to?
The CCSP is ideal for cloud architects, cloud engineers, cloud consultants, cloud administrators, cloud security analysts, cloud specialists, auditors of cloud computing services, and professional cloud developers.
Can I recertify by passing a different ISC2 exam?
ISC2 certifications are renewed by earning CPE credits and paying the annual maintenance fee. Passing a higher-level exam may not automatically renew the CCSP; you must meet the renewal requirements.
Is the CCSP exam available in all countries?
The CCSP exam is delivered at Pearson VUE testing centers worldwide. However, Chinese language exams are only available during specific appointment windows each year.
Information freshness · Content last reviewed on 2026-07-30 Up to date
Practice free questions 1030 questions, free, no account needed.
The curriculum
The whole exam, mapped and written
Every domain, every objective, and every concept ISC2 measures — each one written out.
6domains
38objectives
310concepts
221free pages
The domains, and what sits inside them
Every objective below is a page you can open and practise now, without an account.
The official ISC2 exam outline · checked 30 July 2026 · See the source
1Cloud Concepts, Architecture and Design227 questions
Understand cloud computing concepts17 concepts · 11 pagesOpen →Describe cloud reference architecture6 concepts · 4 pagesOpen →Understand security concepts relevant to cloud computing20 concepts · 12 pagesOpen →Understand design principles of secure cloud computing10 concepts · 7 pagesOpen →Evaluate Cloud Service Providers (CSP)8 concepts · 7 pagesOpen →Comprehend Artificial Intelligence (AI)/Machine Learning (ML)8 concepts · 7 pagesOpen →
2Cloud Data Security237 questions
Describe cloud data concepts3 concepts · 5 pagesOpen →Design and implement cloud data storage architectures2 concepts · 5 pagesOpen →Design and apply data security technologies and strategies12 concepts · 8 pagesOpen →Implement data discovery4 concepts · 5 pagesOpen →Plan and implement data classification7 concepts · 7 pagesOpen →Design and implement Information Rights Management (IRM)8 concepts · 6 pagesOpen →Plan and implement data retention, deletion, and archiving policies4 concepts · 4 pagesOpen →Design and implement auditability, traceability, and accountability of data events7 concepts · 7 pagesOpen →Comprehend data protection of Artificial Intelligence (AI) and Machine Learning (ML) data4 concepts · 5 pagesOpen →
3Cloud Platform and Infrastructure Security116 questions
Comprehend cloud infrastructure and platform components6 concepts · 3 pagesOpen →Design a secure data center9 concepts · 6 pagesOpen →Analyze risks associated with cloud infrastructure and platforms5 concepts · 5 pagesOpen →Plan and implementation of security controls9 concepts · 6 pagesOpen →Plan business continuity (BC) and disaster recovery (DR)8 concepts · 5 pagesOpen →
4Cloud Application Security143 questions
Advocate training and awareness for application security8 concepts · 6 pagesOpen →Describe the Secure Software Development Life Cycle (SDLC) process4 concepts · 6 pagesOpen →Apply the Secure Software Development Life Cycle (SDLC)5 concepts · 5 pagesOpen →Apply cloud software assurance and validation11 concepts · 3 pagesOpen →Use verified secure software10 concepts · 3 pagesOpen →Comprehend and apply the specifics of cloud application architecture13 concepts · 6 pagesOpen →Design appropriate Identity and Access Management (IAM) solutions8 concepts · 3 pagesOpen →
5Cloud Security Operations162 questions
Build and implement physical and logical infrastructure for cloud environment10 concepts · 5 pagesOpen →Operate and maintain physical and logical infrastructure for cloud environment11 concepts · 6 pagesOpen →Implement operational controls and standards (e.g., National Institute Of Standards And Technology (NIST), International Organization For Standardization (ISO), Health Insurance Portability and Accountability Act (HIPPA), Control Objectives For Information And Related Technology (COBIT), Center For Internet Security (CIS) Controls, Comittee Of Sponsoring Organizations (COSO), Information Technology Infrastructure Library (ITIL) International Organization For Standardization/International Electrotechnical Commission (ISO/IEC) 20000-1)14 concepts · 8 pagesOpen →Support digital forensics5 concepts · 3 pagesOpen →Manage communication with relevant parties5 concepts · 5 pagesOpen →Manage security operations7 concepts · 7 pagesOpen →
6Legal, Risk and Compliance145 questions
Articulate legal requirements and unique risks within the cloud environment5 concepts · 5 pagesOpen →Understand privacy issues5 concepts · 5 pagesOpen →Understand audit process, methodologies, and required adaptations for a cloud environment13 concepts · 8 pagesOpen →Understand implications of cloud to enterprise risk management7 concepts · 5 pagesOpen →Understand outsourcing and cloud contract design12 concepts · 7 pagesOpen →
Not a table of contents
Every line on this map already opens
In front of every objective the practice pages are already there, free and without an account. This is one objective, opened.
Understand cloud computing concepts11 pagesOpen →
Free in front of it
52 questions on this objective, five to a page. Every range above is a real page, open now, with no account.
Reading the map is not the same as knowing the ground
The curriculum tells you what is on the exam. Proving you know it is a different job — and it is the one the closed-book run does.
Free questions
1030 questions. No account, no card.
The whole bank is open. 5 questions to a page, every answer explained, and a discussion thread on each one.
1030questions
221pages
38objectives
Freealways
Browse by domain
Every objective, and every page range, is a link — so you can pick up exactly where you left off.
1Cloud Concepts, Architecture and Design227 questions
2Cloud Data Security237 questions
3Cloud Platform and Infrastructure Security116 questions
4Cloud Application Security143 questions
5Cloud Security Operations162 questions
6Legal, Risk and Compliance145 questions
What a practice page gives you
1Five to a page
Short enough to finish, long enough to matter.
2Every answer explained
Not only which one is right — why the others are wrong.
3A discussion on each
Ask, answer, and vote. Every question has its own thread.
A question, and the idea behind it
Every question comes from a concept
These are not trivia. Each one is written against a concept in the book, so when you get one wrong there is somewhere to go and find out why.
The visual book
See it once. Carry it into the exam.
The pages shown here come from our AI-900 book — an example of how each concept is written in plain language and, where the idea needs one, drawn as a full page you can take in at a glance.
310concepts
1030free questions
Why a picture, and not another paragraph
Three reasons, and each one is a real finding rather than a slogan.
You can see it againThe whole idea at onceWhere it starts, what happens in the middle, what comes out, and the mistake to avoid.
Multimedia principle · MayerThe look-alikes sit togetherThe pairs the exam tests are drawn side by side, so the difference is seen, not told.
Dual coding · PaivioWhat one page is made of
You are never asked to read a poster here — only to see how one is built. After that, every other page is legible at a glance.
1A numbered strip on top
The idea as a sequence, followed with a finger before a word is read.
2Panels for the parts
What it is, how the machine learns it, when it is the right tool.
3The trap, framed
The distinction the exam tests, given its own box instead of buried in prose.
4One line at the bottom
The sentence to carry into the exam room.
Open book, on purpose
Answer it with the picture beside you
This is the part that teaches. The illustration and the written explanation stay where they are while you work, so a scenario stops being a memory test and becomes something you can simply look at.
It teaches · it does not count
A smartphone uses AI to unlock when the owner looks at the camera. Which AI capability is being used?
AImage classification
BFacial recognition
COptical character recognition
DObject detection
Look at the five steps. Detect finds a face, align straightens it, encode turns it into numbers, search compares it with a stored face, and decide answers one question: is this the same person? Classification would only say “a face”. Detection would only draw a box. Neither decides whose.
Then the page shuts, and it starts counting
The same questions come back with the book closed — that run is the one that counts. After it, your coach picks one thing for tonight, sized to the time you have, and brings pages back before you lose them.
Testing effect · Roediger & Karpicke 2006 · spacing effect · Cepeda et al. 2006
Official resources
Straight from ISC2
Where the exam is defined, scheduled and scored.
3official links
310concepts mapped
The source
ISC2’s own pages
We link to them rather than repeat them, so nothing here goes stale behind them.
Checked against the source
Every objective on the official ISC2 outline already has questions here
We build from the official skills outline, not from a summary of it — 38 objectives, 310 concepts written under them, and free questions against every one. When ISC2 changes the outline, this page changes with it.
38objectives on the outline→310concepts written→1030free questions
An official page tells you what will be asked. It cannot tell you what you will get right.
That is the only question worth answering the night before, and no link answers it. You answer it by taking the questions with the book closed, and seeing what comes back.