ISC2 CCSP

CCSP Certification: Overview and Career Path [updated 2022]

The Certified Cloud Security Professional (CCSP) certification is an information technology credential that tests knowledge of cloud security topics. Administered by the International Information System Security Certification Consortium (ISC)², it was developed in partnership with the Cloud Security Alliance (CSA) for mid-level professionals who will design, manage and secure assets in the cloud using best practices, policies and procedures.

Is this the right career path for you? If so, read on.

Earn your CCSP, guaranteed!

Save your spot for an upcoming CCSP Boot Camp and earn one of the most in-demand cloud security certifications — guaranteed!

Learn More

How does the CCSP certification differ from other IT certifications?

The CCSP certification focuses on cloud security design, implementation, architecture, operations, controls, compliance and service orchestration. Candidates are tested on their knowledge of cybersecurity tools, techniques and procedures to cloud computing.

The (ISC)² CCSP is far from being the only cloud security-focused certification available. Cloud vendors and other certification organizations have developed several other options to test knowledge of cloud computing concepts and technology. However, the CCSP’s focus on cloud security helps to differentiate it from these other certifications, which normally have a generalist approach or focus more on specific topics such as reverse engineering or digital forensics.

The certificate of cloud security knowledge (CCSK) from CSA is another widely earned certificate for professionals working in cloud security. But as noted by the (ISC)², while CCSP recognizes a candidate’s knowledge and ability in a job role, the CCSK only provides proof of a training course completion. Nevertheless, with its focus on cloud security and vendor-neutral perspective, the CCSK can complement the CCSP and be substituted for one year of experience in cloud security.

What does the CCSP exam cover?

The CCSP exam is designed to test knowledge of everything to do with cloud security. The exam comprises 150 multiple-choice questions (100 operational items and 50 pretest items) to be answered in four hours. The minimum passing score is 700 out of a possible 1000 points.

The questions are broken into six different domains with the following weights:

Domain 1: Cloud concepts, architecture and design (17%)

Domain 2: Cloud data security (20%)

Domain 3: Cloud platform and infrastructure security (17%)

Domain 4: Cloud application security (17%)

Domain 5: Cloud security operations (16%)

Domain 6: Legal, risk and compliance (13%)

The rest of this section provides a brief overview of the topics covered in each domain of the CCSP exam.

Domain 1: Cloud concepts, architecture and design (17%)

The first domain of the CCSP exam covers the background knowledge needed to secure cloud computing systems. This includes basic cloud computing concepts, the various cloud architectures, security concepts relevant to cloud computing, principles of secure cloud computing and identifying trusted cloud services.

Domain 2: Cloud data security (20%)

This domain focuses on everything to do with protecting data on the cloud. Relevant knowledge includes the fundamental concepts of cloud data, security considerations of cloud data storage, tools and techniques for data security, finding and classifying data on the cloud, managing access to data, implementing data retention, deletion and archiving processes and data event management.

Domain 3: Cloud platform and infrastructure security (17%)

The third CCSP domain focuses on the security aspects of cloud infrastructure. A CCSP applicant should know the basic components of cloud infrastructure, be able to design a secure data center, know how to perform a risk assessment, how to design and implement security controls for the cloud and how to integrate cloud computing into their organization’s business continuity/disaster recovery (BC/DR) plan.

Domain 4: Cloud application security (17%)

This CCSP exam section focuses on developing and securing cloud applications. On the development side, applicants should be aware of the unique challenges of developing for the cloud, familiar with software assurance and validation for cloud applications, practice good supply chain management, and understand the software development lifecycle (SDLC). The security side of this domain covers the secure software development lifecycle (SSDLC), cloud-specific security technology and management of identity and access in the cloud.

Domain 5: Cloud security operations (16%)

In this domain, an applicant needs to know how to design, implement, build, run, maintain, and assess the risks of physical and logical cloud infrastructure. This section also tests knowledge of related regulations such as ITIL and ISO/IEC 20000-1, how to collect digital evidence in an incident, how to manage security operations and how to manage communication with all stakeholders in the cloud environment.

Domain 6: Legal, risk and compliance (13%)

The final domain of the CCSP is focused on any cloud-specific laws and regulations not covered in earlier domains. This includes how the cloud affects regulatory compliance, jurisdiction-specific privacy regulations, auditing and risk management. Also covered are management of the supply chain, outsourcing and vendor contracts.

What do I need for the CCSP certification?

To embark on your journey to become CCSP-certified, you must have at least five years of cumulative paid work experience in information technology, of which three years must be in information security and one year in one or more of the six domains of the CCSP CBK. However, as noted earlier, earning CSA’s CCSK certificate can be substituted for one year of experience and the (ISC)²’s CISSP credential can be substituted for the entire CCSP experience requirement.

You can still take the exam if you don’t have the certification requirements. If you pass, you become a CCSP associate until you accumulate the relevant experience; you will have six years to earn the five years of the required experience.

The CCSP certificate is good for three years without renewal. To keep your certification active, you’ll need to earn 30 CPE credits per year and 90 CPE credits throughout the three-year certification cycle. In addition, you’ll have to pay an annual maintenance fee of $125.

Should I take the CCSP exam?

(ISC)²’s CCSP exam allows cloud security practitioners to demonstrate their knowledge and skillsets in that field. The exam content is narrowly focused on cloud computing and the knowledge of theory, tools and techniques necessary to secure it properly.

The experience requirements of the CCSP exam mean that it’s not a great choice for those fresh out of college and looking to specialize in cloud computing. The five-year information technology requirement shows that the exam targets mid-level rather than entry-level security professionals on different cloud career paths.

On the other hand, if you want to break into the cloud security field, this exam may be a good fit for you. If you are already a CISSP, you automatically meet the eligibility requirements for the exam. If you have the experience except for the cloud security background, consider pursuing the CCSK and then the CCSP. This allows you to waive the requirement for cloud security experience for the CCSP and use the certification to help get a job in the field.

With the popularity of cloud technology and the upsurge in data breaches, proving you have the skills to protect an organization’s data is a great asset. Research finds that (ISC)²’s CCSP is one of the most common certifications that IT professionals pursue. The average salary for a CCSP is around $133,740 in the U.S., according to CertMag.

Earn your CCSP, guaranteed!

Save your spot for an upcoming CCSP Boot Camp and earn one of the most in-demand cloud security certifications — guaranteed!

Learn More

How do I prepare for the CCSP exam?

The CCSP exam covers several topics, so preparation is the key to earning a passing grade. A couple of options include any of the official (ISC)² textbooks or enrolling in a boot camp-style training program covering hands-on domain knowledge.

If you decide to go the self-study route, (ISC)² has published an official guide to the CCSP exam. By going through the guide in-depth and taking a few practice tests, applicants can prepare themselves for the test.

If this seems a bit daunting, a training course may be a better choice. Taking this CCSP learning path gives you the advantage of having access to a CCSP expert throughout the training process, ensuring that all your questions will be answered.

For more on the CCSP certification, check out our CCSP certification hub.

Sources:

• CCSP, (ISC)2
• Certification Exam Outline: CCSP, (ISC)2
• How much does a CCSP make?, (ISC)2
• The Ultimate Guide to the CCSP, (ISC)2
• Make Your Move to Next-Level Cloud Security, (ISC)2
• Comparing the CCSP and CCSK Cloud Security Credentials, (ISC)2
• Cloud Computing Certification Survey, Certification Magazine
• Salary Survey 2022: An all-new Salary Survey 75, Certification Magazine
• Salary Survey Extra: What is your most recently earned IT certification?, Certification Magazine