ISC2 CCSP: Cost, the New CAT Exam Format, and the CISSP Waiver Path

Something changed underneath this exam in late 2025, and most of what is written about CCSP online has not caught up. This page covers that shift, what the exam costs and tests now, the five-year experience requirement and the one waiver that erases it completely, the six domains and their weights, and nine years of renewal.

Who this cert is actually for

Cloud-focused security work is the target here: architects, engineers, and consultants securing workloads across AWS, Azure, GCP, or multi-cloud environments, not generalists who happen to touch cloud consoles occasionally. ISC2 requires five years of cumulative, full-time, paid IT experience, with three of those years specifically in cybersecurity and at least one year in one or more of the six current CCSP domains. Part-time work and internships can count toward the total. Up to one year of the five can be waived by a relevant bachelor’s or master’s degree in computer science or IT, or by holding the Cloud Security Alliance’s CCSK certificate; only one of those substitutions applies, capped at one year total.

The waiver that actually matters for most people already in this field: an active CISSP substitutes for the entire CCSP experience requirement, not just a portion of it. If you already hold CISSP, you can sit the CCSP exam and receive full certification immediately on passing, with no cloud-specific work history to document. That makes CCSP a fast, credible add-on for CISSP holders moving into cloud-focused roles, distinct from certifications where CISSP only trims a year or two off the requirement. CISSP vs CCSP walks through that add-on path in full.

If you do not have the experience and do not hold CISSP, ISC2’s Associate of ISC2 path applies here too: pass the exam now, and you get six years to accumulate the required experience while holding Associate status. Skip CCSP if your work is general security rather than cloud-specific; ISC2 CISSP or a vendor cloud-security specialty like AWS Security Specialty may fit your actual day-to-day better.

What it costs all-in

The exam is $599 direct from ISC2, with no membership tier or discount schedule the way ISACA prices its certifications; every candidate pays the same $599 regardless of prior ISC2 credentials. There is no free retake, so a failed attempt costs another $599.

ISC2’s own exam outline is the free syllabus. Because CCSP spans cloud architecture, data security, platform security, application security, operations, and legal and compliance rather than one narrow skill set, a dedicated CCSP study guide or video course in the $40 to $70 range and a practice-question bank in the $30 to $50 range are worth the money for most candidates, since the breadth of the six domains makes gaps easy to miss with reading alone. A realistic self-study budget is $599 for the voucher plus $70 to $120 in prep. Weigh that all-in figure against every other credential this site tracks on the ROI Index.

The exam itself

Here is the format change that matters most on this page. Effective October 1, 2025, ISC2 moved the CCSP exam from a fixed 125-question linear format to computerized adaptive testing (CAT), the same testing model CISSP has used since 2017. Under CAT, the exam now serves a minimum of 100 and a maximum of 150 questions over a maximum of three hours, with the exact count depending on how quickly the adaptive algorithm can confirm your ability relative to the pass point, not a number set in advance. ISC2 states the CAT version is “based on the same exam content outline as the linear, fixed form,” meaning the domains and their weights carried over unchanged even though the delivery mechanism did not. If you are studying from material written before October 2025, expect it to describe the old 125-question linear format; that description is now out of date for anyone testing today. A passing result is a scaled score of 700 out of a possible 1,000 points, matching CISSP’s scale exactly. ISC2 does not publish a pass rate for CCSP.

Six domains make up the exam content: Cloud Concepts, Architecture and Design (17 percent), Cloud Data Security (20 percent, the single largest domain), Cloud Platform and Infrastructure Security (17 percent), Cloud Application Security (17 percent), Cloud Security Operations (16 percent), and Legal, Risk and Compliance (13 percent). Those six weights sum to exactly 100 percent. Note that ISC2 has stated a new CCSP exam outline takes effect August 1, 2026, so anyone testing on or after that date should check ISC2’s exam outline page directly rather than relying on the domain breakdown above.

Renewal math over 9 years

CCSP is valid for three years, so nine years covers three renewal cycles. Each cycle requires 90 CPE credits, a lighter load than CISSP’s 120, with at least 60 of those credits required from Group A activity directly tied to the six cloud-security domains and up to 30 from Group A or B combined. ISC2 also sets an annual minimum of 20 CPEs, with at least 10 from Group A, so the requirement cannot be left entirely to the last few months of the cycle.

The Annual Maintenance Fee is $135 a year, the same higher-tier rate CISSP, SSCP, CGRC, and several other ISC2 credentials carry. Crucially, ISC2 charges one combined AMF regardless of how many of its certifications you hold, so a CISSP holder who adds CCSP does not pay $270 a year; the fee stays at $135 total, billed on the earliest certification anniversary among your ISC2 credentials. Budget $405 per three-year cycle and $1,215 across nine years in AMF, the same fixed floor CISSP carries, on top of whatever the CPE-gathering activities themselves cost.

What it does for the occupation you are entering

CCSP maps to the information security analyst occupation (BLS code 15-1212), though CCSP holders in practice more often carry titles like cloud security architect or cloud security engineer that the BLS occupational structure does not break out on its own. The panel on this page shows the current national median wage and headcount for the broader occupation; read it as a description of the field CCSP sits inside, not a wage this specific certificate pays out on its own. The Bureau of Labor Statistics projects continued strong growth in information security roles generally, and cloud-specific demand within that occupation has been a consistent driver as organizations shift workloads off on-premises infrastructure. What CCSP concretely buys a candidate is a vendor-neutral signal that they understand cloud security architecture and shared-responsibility models across providers, rather than expertise locked to one cloud platform’s certification track.

Common mistakes

Studying the old 125-question linear format. The October 2025 shift to CAT changed the question range and how the exam concludes, even though the domain content stayed the same. Study guides and forum posts written before that date describe an exam that no longer runs the way it is delivered today.

Assuming the CISSP waiver only trims part of the requirement. Unlike CISM, where an active CISSP waives two of five years, CCSP’s CISSP substitution erases the entire experience requirement. CISSP holders who assume they still need to document a year of cloud work are leaving a shortcut on the table.

Ignoring the shared AMF when stacking ISC2 credentials. Because ISC2 bills one combined Annual Maintenance Fee across all its certifications, candidates sometimes budget $135 per credential rather than $135 total. Confirm your actual AMF due date rather than assuming duplicate charges.