Begin with the August2026 outline
ISC 2 introduced a new CCSP outline effective 1 August 2026. Prepare against the current outline rather than treating an earlier book’s structure as definitive. The six domains concern cloud concepts and architecture, data security, platform and infrastructure, application security, operations, and legal/risk/compliance.
The certification has a separate professional-experience route: five years in IT, including three in cybersecurity and one in a CCSP domain, subject to the programme’s recognised provisions. Its experience page describes specific degree or CCSK-related substitutions and other recognised routes. Do not assume that every cloud course or credential supplies a waiver.
Create a responsibility map for one workload
Illustrative workload: a business hosts a customer-support application and its records in a cloud service. Record the service model, data owner, administrator roles, supplier responsibilities and operational dependencies. Identify which decisions the organisation controls and which evidence it needs from the provider.
For each control, ask who configures it, who monitors it and who responds when it fails. Encryption might be available while key permissions remain inappropriate. A supplier’s infrastructure assurance does not automatically prove that the customer configured application access correctly. Explain the boundary rather than writing that security is shared and stopping there.
Follow the data from collection to deletion
Describe what information enters the application, where it is stored, who can retrieve it and how it reaches backups, logs or support tools. Identify the business reason for each copy. Test your proposed retention and deletion approach against those copies rather than focusing only on the primary database.
Consider changes in data sensitivity or location as scenario variations. Explain which access, contractual, monitoring or recovery decisions need review. Use only synthetic or properly authorised information in exercises. A governance note should distinguish a legal requirement, a contractual commitment and the organisation’s preferred practice.
Practise architecture and operational failure together
Choose one disruption, such as a dependency outage or mistaken privileged configuration. Explain how it would be detected, what would contain its impact, who has authority to act and what evidence supports restoration. Distinguish service availability from restoration of trustworthy data.
Review supplier evidence critically. A general service statement may not describe your subscription, configuration or recovery commitment. Record the limitation and the additional assurance required. These questions connect the architecture, operations and risk domains without claiming that one vendor’s implementation is the universal CCSP answer.
Build a small application-security review
For the illustrative application, identify how changes are approved, secrets are protected, dependencies are evaluated and security defects are handled. Link each concern to a concrete artefact such as an access record, a change approval or a test result. Avoid treating a passed scan as proof that every application risk is resolved.
Use authorised practice questions to check whether you can interpret the service model and select a response for the stated responsibility. When you miss a question, record the boundary or assumption you misunderstood, then revisit the relevant outline section. Practise explaining why an alternative belongs to a different owner or does not address the requirement.
A cloud access and evidence drill
Build a fictional responsibility table with four activities: approving privileged access, configuring the tenant, protecting infrastructure and reviewing customer audit logs. Assign an owner under the service model you assume, and record which assignment must be confirmed in supplier documentation. A different service model may change the boundary.
Next, describe how the organisation would demonstrate that a temporary administrator lost access after a task. Identify the approval, role assignment, expiry or removal event and review evidence. If the logging service is controlled by the provider, note what access and retention evidence the customer needs. This is a concrete way to practise responsibility and assurance together without treating a provider certificate as proof of every customer control.
CCSP planning questions
Is CCSP only for one cloud platform? Its cloud-security scope is not a substitute for a single vendor’s implementation certification. Product experience helps, but preparation must reach the broader responsibilities in the outline.
Can I reuse an old exam-format summary? Use the current outline and booking information, especially after the August 2026 change. Does passing finish certification? Follow the experience, endorsement and other certification steps applicable to you. Plan continuing development after award, and keep professional eligibility separate from any training or voucher purchase.
Official references
Certification requirements and programme terms can change. Use the issuer’s current page and your account to confirm details before applying or paying.