In SaaS, who is typically responsible for managing user access to the application data?
Domain 1
Answer: B · whyEven in SaaS the customer manages its users, access and data.
ISC2 · Cloud Security
CCSP - Certified Cloud Security Professional
Cloud security architects, engineers, consultants and GRC professionals who assess or govern cloud services (SaaS/IaaS/PaaS), including cloud vendor risk and compliance.
Overview
- Prerequisites
- 5 years cumulative, full-time IT experience, of which 3 years in information security and 1 year in one or more of the 6 CCSP domains. CSA's CCSK can substitute 1 year, or a relevant degree up to 1 year (maximum 1 year waived). An active CISSP substitutes for the entire experience requirement. Associate of ISC2 route available.
- Maintenance
- Earn 90 CPE credits per 3-year cycle (60 Group A + 30 Group A or B; ISC2 suggests about 30 a year) and pay the ISC2 annual maintenance fee.
- Outline in effect
- 1 Aug 2026
Exam facts
- Questions
- 100-150 items
- Duration
- 3 hours
- Question types
- Multiple choice and advanced item types
- Passing score
- 700 out of 1000
- Format
- Computerized Adaptive Testing (CAT) since 1 Oct 2025
- Delivery
- Pearson VUE test centres
- Languages
- English, Chinese, Japanese, German
Cost
- Exam fee
- US$599 (Americas, Asia-Pacific, Middle East, Africa); EUR 575.04 (EMEA); GBP 485.19 (UK)
- Notes
- US$135 ISC2 annual maintenance fee after certification (single fee across ISC2 certifications).
Domains & weights
- 1. Cloud Concepts, Architecture and Design17%
- 2. Cloud Data Security20%
- 3. Cloud Platform and Infrastructure Security17%
- 4. Cloud Application Security16%
- 5. Cloud Security Operations17%
- 6. Legal, Risk and Compliance13%
Upcoming changes
No announced changes as of 19 Oct 2026.
Study plan
- Week 1
Domain 1
- Cloud definitions, roles (CSC, CSP, partner, broker), characteristics, reference architecture, service and deployment models, shared responsibility.
- Read the 1 Aug 2026 outline.
- Week 2
Domain 1 + AI/ML
- Design principles, BC/DR in cloud, CSP evaluation (Common Criteria, FIPS 140), new AI/ML subdomain topics.
- Week 3
Domain 2
- Data life cycle, storage types, encryption and key management, tokenisation, masking, DLP, discovery, classification, IRM, retention and legal hold.
- Week 4
Domain 3
- Infrastructure components, secure data centre design, risk analysis, controls, BC/DR planning (RTO/RPO).
- Week 5
Domain 4
- Secure SDLC, OWASP Top 10 / ASVS / LLM Top 10, threat modelling (STRIDE, PASTA), testing types, API security, IAM in cloud apps (federation, SSO, CASB).
- Week 6
Domain 5
- HSM/TPM, hardening, patching, ITSM processes (ISO/IEC 20000-1 / ITIL), forensics, SOC operations, log analysis.
- Week 7
Domain 6
- Conflicting laws, eDiscovery, privacy laws (GDPR, HIPAA, DPDP Act), ISO/IEC 27018, audit reports (SOC 1/2/3, ISAE), cloud contracts and vendor risk.
- Week 8
Practice and review
- Two timed CAT-style practice exams; revisit Domain 2 (20%).
Exam tips
- CAT exams do not let you go back or skip: answer each item, then move on. Do not panic if questions feel hard - that usually means you are performing well.
- You need 700/1000 on the scaled score; the exam can end anywhere between the minimum and maximum number of items.
- Pace yourself: with up to 150 items in 3 hours you have just over a minute per item; schedule a short break if offered.
- Book at a Pearson VUE centre well in advance and bring the IDs required by ISC2's exam policies.
- Always ask who is responsible under the shared responsibility model for the service model in the question (SaaS vs PaaS vs IaaS).
Common pitfalls
- Using pre-Aug-2026 materials without checking the new AI/ML subdomains.
- Forgetting that the cloud customer always remains accountable for its data.
- Confusing SOC 1 (financial reporting controls) with SOC 2 (security/availability/etc.).
Resources & official links
Official
- CCSP Certification Exam Outline (effective 1 Aug 2026)
- ISC2 CCSP Official Study Guide and Practice Tests (Sybex)
Also widely used
- CSA Security Guidance and Cloud Controls Matrix (CCM)
- CSA CCSK body of knowledge
- OWASP Top 10 and OWASP Top 10 for LLM Applications
- ISO/IEC 27017 and 27018
Sources
- ISC2 CCSP exam outline page (format, weights, experience)
- ISC2 Insights: CCSP exam outline revised (30 Jun 2026)
- ISC2: CAT format updates for CC, SSCP, CCSP (14 May 2025)
- ISC2 exam pricing
- ISC2 Annual Maintenance Fees overview
- ISC2 Certification Maintenance (CPE) Handbook
Last verified 19 Oct 2026. Values marked “check official site” could not be confirmed from an official source.
Practice questions
Which cloud characteristic allows a customer to scale resources up and down quickly?
Domain 1
Answer: B · whyRapid elasticity is the ability to provision and release capacity on demand.
Which technique replaces sensitive data with a non-sensitive surrogate that maps back via a secure vault?
Domain 2
Answer: B · whyTokenisation substitutes a token and keeps the mapping in a protected vault.
Where should encryption keys for highly sensitive cloud data ideally be controlled?
Domain 2
Answer: B · whySeparating keys from data and keeping customer control reduces exposure.
A legal hold requires the organisation to:
Domain 2
Answer: B · whyLegal holds suspend retention-based deletion for relevant records.
Which control MOST directly limits blast radius between workloads in the same cloud account?
Domain 3
Answer: B · whySegmentation restricts lateral movement between workloads.
STRIDE is used for:
Domain 4
Answer: B · whySTRIDE classifies threats: Spoofing, Tampering, Repudiation, Information disclosure, DoS, Elevation of privilege.
Which device provides tamper-resistant protection for cryptographic keys in a cloud data centre?
Domain 5
Answer: B · whyHSMs generate and protect keys in tamper-resistant hardware.
Which report would a cloud customer typically request to gain assurance over a CSP's security controls?
Domain 6
Answer: B · whySOC 2 Type II covers design and operating effectiveness of Trust Services controls over a period.
Conflicting international laws are a key cloud risk mainly because:
Domain 6
Answer: A · whyData location across borders can trigger conflicting legal obligations.