CCSP study guide · 2026

The 6 CCSP domains, explained

6 domains and 38 official subdomains. Cloud Data Security carries the most weight at 20%. Each guide explains what the domain covers, how its questions are framed and where candidates lose marks.

Start with Domain 2 See all domains
Questions
100–150 (adaptive)
Time
3 hours
Passing score
700 / 1000
Outline
Exam Outline effective 1 August 2026 (current)

Exam blueprint

Bar widths follow the official weights. Weight ranges are drawn at their midpoint.

  1. 1 17%
  2. 2 20%
  3. 3 17%
  4. 4 16%
  5. 5 17%
  6. 6 13%
  1. 1 Cloud Concepts, Architecture and Design
  2. 2 Cloud Data Security
  3. 3 Cloud Platform and Infrastructure Security
  4. 4 Cloud Application Security
  5. 5 Cloud Security Operations
  6. 6 Legal, Risk and Compliance

All 6 domains

38 official subdomains 150–205 hrs suggested study

  1. Domain 01 17%

    Cloud Concepts, Architecture and Design

    This domain sets the vocabulary and design logic for the rest of the CCSP. It covers roles, service and deployment models, cloud-specific security concepts, secure design and how to judge a provider. Get this right and the other five domains make sense.

    Inside this domain

    • Understand cloud computing concepts
    • Describe cloud reference architecture
    • Understand security concepts relevant to cloud computing
    • Understand design principles of secure cloud computing
    • and 2 more subdomains

    Watch for Provider handles it

    Subdomains
    6
    Questions est.
    17–26
    Study time est.
    25–35 hrs
  2. Domain 02 20%

    Cloud Data Security

    Cloud Data Security is the heaviest CCSP domain. It covers how data moves and is stored in the cloud, the technologies that protect it, and the policies that govern it from creation to destruction. The exam tests whether you can match the right control to the right data, phase and threat.

    Inside this domain

    • Describe cloud data concepts
    • Design and implement cloud data storage architectures
    • Design and apply data security technologies and strategies
    • Implement data discovery
    • and 5 more subdomains

    Watch for Encryption for scope reduction

    Subdomains
    9
    Questions est.
    20–30
    Study time est.
    30–40 hrs
  3. Domain 03 17%

    Cloud Platform and Infrastructure Security

    This domain covers the layer everything else runs on: physical facilities, networks, compute, virtualization, storage and the management plane that controls them. It also covers how to analyze their risks, choose controls and plan continuity and recovery.

    Inside this domain

    • Comprehend cloud infrastructure and platform components
    • Design a secure data center
    • Analyze risks associated with cloud infrastructure and platforms
    • Plan and implementation of security controls
    • and 1 more subdomains

    Watch for Harden the workloads first

    Subdomains
    5
    Questions est.
    17–26
    Study time est.
    25–35 hrs
  4. Domain 04 16%

    Cloud Application Security

    Cloud Application Security covers building, testing and running software safely in the cloud: secure development, threat modeling, testing methods, the software supply chain, supporting security components and identity. The exam tests whether you pick the right technique at the right stage.

    Inside this domain

    • Advocate training and awareness for application security
    • Describe the Secure Software Development Life Cycle (SDLC) process
    • Apply the Secure Software Development Life Cycle (SDLC)
    • Apply cloud software assurance and validation
    • and 3 more subdomains

    Watch for WAF as a fix

    Subdomains
    7
    Questions est.
    16–24
    Study time est.
    25–35 hrs
  5. Domain 05 17%

    Cloud Security Operations

    Cloud Security Operations is the day-to-day work of keeping cloud environments secure: building and hardening infrastructure, operating and patching it, running service management processes, handling forensics and communication, and staffing security monitoring and response.

    Inside this domain

    • Build and implement physical and logical infrastructure for cloud environment
    • Operate and maintain physical and logical infrastructure for cloud environment
    • Implement operational controls and standards
    • Support digital forensics
    • and 2 more subdomains

    Watch for Kill it first

    Subdomains
    6
    Questions est.
    17–26
    Study time est.
    25–35 hrs
  6. Domain 06 13%

    Legal, Risk and Compliance

    Legal, Risk and Compliance covers the rules around cloud services: conflicting laws, eDiscovery and forensics standards, privacy obligations, audits and assurance reports, enterprise risk, and the contracts that bind provider and customer. It is the lightest domain by weight and one of the most precisely tested.

    Inside this domain

    • Articulate legal requirements and unique risks within the cloud environment
    • Understand privacy issues
    • Understand audit process, methodologies, and required adaptations for a cloud environment
    • Understand implications of cloud to enterprise risk management
    • and 1 more subdomains

    Watch for Provider is the controller

    Subdomains
    5
    Questions est.
    13–20
    Study time est.
    20–25 hrs

Study the heaviest domains first

Marks follow weight. This order puts the most marks behind you first, across about 150–205 hrs of study.

  1. 2 Cloud Data Security 20% · 30–40 hrs
  2. 1 Cloud Concepts, Architecture and Design 17% · 25–35 hrs
  3. 3 Cloud Platform and Infrastructure Security 17% · 25–35 hrs
  4. 5 Cloud Security Operations 17% · 25–35 hrs
  5. 4 Cloud Application Security 16% · 25–35 hrs
  6. 6 Legal, Risk and Compliance 13% · 20–25 hrs

Try one

Practice questionDomain 2: Cloud Data Security

A company's retention policy requires deleting customer support records after five years. Several records reaching that age relate to a lawsuit, and legal counsel has issued a preservation notice. What should the cloud security professional do?

One trap from every domain

The answer that looks right, and the clue that gives it away.

  • Domain 1

    Provider handles it

    Clue The scenario involves user permissions, sharing settings or data exposure inside a SaaS tool.

  • Domain 2

    Encryption for scope reduction

    Clue The goal stated is reducing the number of systems in scope.

  • Domain 3

    Harden the workloads first

    Clue The question asks which asset's compromise has the GREATEST impact.

  • Domain 4

    WAF as a fix

    Clue The question asks for the BEST long-term remediation.

  • Domain 5

    Kill it first

    Clue The question asks what to do FIRST, or mentions investigation or legal action.

  • Domain 6

    Provider is the controller

    Clue The data belongs to the customer's own customers or employees.

Other Cybersecurity certifications

Study guides for exams that overlap with CCSP.

Practise what you read

CCSP domains: common questions

How many domains are in the CCSP exam?

CCSP has 6 domains with 38 official subdomains between them: Cloud Concepts, Architecture and Design, Cloud Data Security, Cloud Platform and Infrastructure Security, Cloud Application Security, Cloud Security Operations and Legal, Risk and Compliance.

Which CCSP domain carries the most weight?

Cloud Data Security is the heaviest at 20%, followed by Cloud Concepts, Architecture and Design (17%). The lightest is Legal, Risk and Compliance (13%). Weights come from ISC2's official outline.

What is the CCSP exam format?

Questions: 100–150 (adaptive). Time allowed: 3 hours. Passing score: 700 / 1000.

How long should I study for CCSP?

Our planning estimate is 150–205 hrs across all domains, split by weight. It is an editorial estimate, not an official figure, so adjust it to your experience and to how you score on practice questions.

Where should I start?

Start with Cloud Data Security, because it carries the most marks, then work down by weight. Use the checklist on each domain page to confirm you can do what the domain asks before moving on.

Which outline is this guide based on?

This guide follows Exam Outline effective 1 August 2026 (current), published by ISC2. It was last reviewed in October 2026.

Domain names, weights and subdomains come from ISC2's official outline (Exam Outline effective 1 August 2026 (current)). Question counts and study hours are editorial planning estimates, not official figures. Last reviewed October 2026.