If you are booked to sit the ISC2 Certified Cloud Security Professional (CCSP) exam, note the date at the top of this post. ISC2 states plainly that "effective August 1, 2026, the CCSP exam will be based on a new exam outline." That outline is now live, and ISC2 has published its domain weights. If your study materials were written for the previous outline, check what has moved before you walk into the test centre. Here is what changed, the new weights, and how to prepare.

What is actually changing

An ISC2 exam outline defines the domains the exam covers and how heavily each is weighted. A new outline does not usually rewrite cloud security from scratch, but it does rebalance emphasis and refresh the underlying tasks and knowledge, which is enough to make an old study plan point in slightly the wrong direction.

The CCSP continues to be built on six domains:

  1. Cloud Concepts, Architecture and Design: 17%
  2. Cloud Data Security: 20%
  3. Cloud Platform and Infrastructure Security: 17%
  4. Cloud Application Security: 16%
  5. Cloud Security Operations: 17%
  6. Legal, Risk and Compliance: 13%

Those are the weights ISC2 publishes for the new outline. The domain names carry over, so the shape of the exam is familiar. Against the previous outline, Cloud Application Security drops a point and Cloud Security Operations gains one; the other four are unchanged. ISC2 also says the subdomains beneath each domain have been revised, so the detail you study matters as much as the percentages.

The exam format you are preparing for

Format and outline are different things. The outline is the syllabus; the format is how the exam is delivered, and ISC2's published format for the CCSP is:

  • Computerised Adaptive Testing (CAT)
  • 100 to 150 items, multiple choice and advanced item types
  • 3 hours
  • Passing score of 700 out of 1000 points

The word that should shape your preparation is adaptive. In a CAT exam, the questions adjust to your performance as you go, and you cannot flag a question and return to it later. That changes your strategy in three concrete ways: you must commit to an answer and move on, early questions carry real weight in calibrating your level, and there is no "come back at the end" safety net. Practising under those exact conditions matters more here than on a traditional linear paper.

Eligibility, and the two shortcuts people miss

The standard requirement is a minimum of five years' cumulative, full-time IT experience, with three years in cybersecurity and one year in one or more of the six CCSP domains. Two official routes around that are worth knowing:

  • The CISSP waiver. An active CISSP credential substitutes for the entire CCSP experience requirement. If you already hold the CISSP, the experience gate is cleared.
  • The Associate of ISC2 pathway. If you do not yet have the experience, you can pass the CCSP exam first and become an Associate of ISC2, then you have six years to earn the five years of experience required to convert to full CCSP.

Neither of these changes with the new outline, but both are routinely overlooked by candidates who assume they cannot sit the exam yet.

How to prepare from here

  • Weight your revision to the new outline. Cloud Data Security is the largest domain at 20%; Legal, Risk and Compliance is the smallest at 13%. Download the current outline from ISC2 for the subdomain detail.
  • Rehearse the adaptive format, not just the content. Full, timed practice under CAT-style conditions, where you commit and move on, builds the decision discipline the real exam demands.
  • Anchor on the six domains. Legal, Risk and Compliance is small but high-yield and often under-practised; Cloud Data Security and Operations reward hands-on familiarity, not memorisation.
  • Check the date on every resource. A guide that predates 1 August 2026 is not useless, but its emphasis may be off. Confirm it against the current outline.

Practise under real exam conditions

Because the CCSP is adaptive and unforgiving of second-guessing, the quality of your practice is what separates a confident pass from a near miss. Full, timed mock exams that force you to commit to each answer and move on train the exact behaviour CAT requires, and scoring by domain shows you where the new outline is costing you marks. CandidatesPrep's simulator runs timed, domain-scored mocks so you can rehearse the format as well as the content, and trainers preparing cloud-security cohorts can track readiness across a whole group.

The bottom line

The CCSP's structure is stable: six domains, an adaptive format, a 700-out-of-1000 bar. What changed on 1 August 2026 is the outline underneath: revised subdomains and a small shift in weights. Study to ISC2's current published outline rather than to any second-hand summary, rehearse the adaptive format, and the outline change becomes a detail rather than a derailment.

Sitting the CCSP soon, or preparing a team? Rehearse under timed, adaptive-style conditions, or book a demo to see domain-level analytics for your cohort.