TL;DR: Choose CISSP if you want the broad, widely recognized security credential that covers eight domains from risk management to software development security. Choose CCSP if your day job is cloud security and you want a credential built around cloud architecture, data, platforms, applications, operations and legal and compliance. Both are ISC2 certifications with five-year experience requirements, both use computerized adaptive testing and both carry the same annual maintenance fee of USD 135 (paid once if you hold both). The exam fee is USD 749 for CISSP and USD 599 for CCSP. The decision that saves you the most money: an active CISSP can substitute for the entire CCSP experience requirement, so CISSP first and CCSP second is a short step, while CCSP first does not shorten the CISSP path.
Quick Facts
| Item | CISSP | CCSP |
| Issuer | ISC2 | ISC2 |
| Scope | Broad security leadership and practice, 8 domains | Cloud security, 6 domains |
| Exam fee | USD 749 | USD 599 |
| Format | Computerized adaptive testing (CAT) | Computerized adaptive testing (CAT) |
| Exam items | 100 minimum, up to 150 reported | 100 to 150 |
| Time limit | 3 hours in the CAT format | 3 hours |
| Passing score | 700 out of 1,000 (as reported) | 700 out of 1,000 (as reported) |
| Experience | 5 years cumulative, paid work in 2 or more of the 8 domains | 5 years cumulative, full-time IT experience, 3 in cybersecurity and 1 in one or more of the 6 CCSP domains |
| Experience waiver | Up to 1 year (degree or approved credential) | Up to 1 year (degree or CCSK), or an active CISSP replaces the whole requirement |
| Not enough experience yet | Pass the exam and become an Associate of ISC2, with up to 6 years to earn the experience | Pass the exam and become an Associate of ISC2, with 6 years to earn the 5 years required |
| Annual maintenance fee | USD 135 (one fee if you hold several ISC2 certifications) | USD 135 (one fee if you hold several ISC2 certifications) |
| CPE credits | 120 over a 3-year cycle | 90 over a 3-year cycle |
Fees, experience rules and CPE figures come from ISC2’s pricing, maintenance fee, experience and member policy pages. Format details for CISSP combine ISC2’s adaptive testing announcement with third-party reports, so confirm them on ISC2’s current pages before you register. Checked in November 2026.
What Each Certification Is For
CISSP: Security across the whole program
CISSP is the generalist’s credential. It covers security and risk management, asset security, security architecture and engineering, communication and network security, identity and access management, security assessment and testing, security operations and software development security. It suits people who design, manage or advise on security programs and who need to speak across several technical and business areas.
Typical roles: security manager, security architect, security consultant, security analyst moving up, CISO track.
CCSP: Security inside the cloud
CCSP focuses on securing cloud environments. Its six domains are cloud concepts, architecture and design; cloud data security; cloud platform and infrastructure security; cloud application security; cloud security operations; and legal, risk and compliance. It suits people who design, secure or audit workloads on cloud platforms.
Typical roles: cloud security engineer, cloud security architect, cloud compliance specialist, security consultant for cloud migrations.
A short way to hold the difference: CISSP asks “how do I run security across the organization?” while CCSP asks “how do I secure what runs in the cloud?”
Domains Side by Side
| CISSP domain | Weight (April 2024 outline) |
| Security and Risk Management | 16% |
| Asset Security | 10% |
| Security Architecture and Engineering | 13% |
| Communication and Network Security | 13% |
| Identity and Access Management (IAM) | 13% |
| Security Assessment and Testing | 12% |
| Security Operations | 13% |
| Software Development Security | 10% |
| CCSP domain | Weight (reported for the outline effective August 1, 2026) |
| Cloud Concepts, Architecture and Design | 17% |
| Cloud Data Security | 20% |
| Cloud Platform and Infrastructure Security | 17% |
| Cloud Application Security | 16% |
| Cloud Security Operations | 17% |
| Legal, Risk and Compliance | 13% |
Notes on these tables:
- CISSP weights are spread evenly. No single domain exceeds 16%, so you cannot skip a domain and recover elsewhere. ISC2’s current CISSP outline is dated April 15, 2024.
- CCSP weights lean on data. Cloud data security is the largest domain at 20%. The CCSP weights shown are reported by third-party sources, because ISC2’s outline page lists the six domains without percentages in the content reviewed, so confirm them on ISC2’s page.
- A new CCSP outline took effect on August 1, 2026, according to ISC2’s outline page and its June 2026 announcement. Reports describe more attention to AI and machine learning topics inside the same six domains, but check the outline itself before you plan study time. Our CCSP exam outline update guide covers what changed.
- Third-party sources report that ISC2 has published a new CISSP outline effective April 15, 2027. Until then the April 2024 outline applies to current sittings. Verify on ISC2’s CISSP outline page and use the outline that matches your exam date.
Experience Requirements
This is where the two paths differ most.
CISSP
You need a minimum of five years of cumulative, paid work experience in two or more of the eight CISSP domains. ISC2’s experience page describes part-time work, internships and one-year waivers, and ISC2 updated its waiver list effective April 1, 2026. A waiver can reduce the requirement by one year at most, so check ISC2’s current page for which degrees and credentials qualify before you count on one.
CCSP
The CCSP requires a minimum of five years of cumulative, full-time experience in information technology. Three of those years must be in cybersecurity, and one year must be in one or more of the six CCSP domains. ISC2’s page lists these waivers:
- A bachelor’s or master’s degree in computer science, IT or a related field can satisfy up to one year.
- The Cloud Security Alliance’s CCSK certificate can substitute for one year.
- Only one year can be waived through a degree or the CCSK.
- An active CISSP can substitute for the entire CCSP experience requirement.
If you do not have the experience yet
For both, you can pass the exam and become an Associate of ISC2. ISC2 describes up to six years to earn the required experience for the CISSP, and the CCSP page says the associate has six years to earn the five required. Associates of ISC2 pay an annual fee of USD 50, due on the anniversary of achieving associate status. Associates should not use the full designation until the experience is approved.
The practical consequence: if you already hold the CISSP, the CCSP is mostly an exam, not an experience hurdle. If you hold the CCSP, you still need the CISSP experience in full.
Exam Format and Fees
| Item | CISSP | CCSP |
| Exam fee | USD 749 | USD 599 |
| Format | CAT | CAT |
| Items | 100 minimum, up to 150 reported | 100 to 150 |
| Time | 3 hours in the CAT format | 3 hours |
| Exam window | 365 days from purchase for the exam-only option | 365 days from purchase for the exam-only option |
| Attempts included | 1 (exam only), or 2 with Peace of Mind Protection | 1 (exam only), or 2 with Peace of Mind Protection |
| Reschedule fee | USD 50 | USD 50 |
| Cancel fee | USD 100 | USD 100 |
Points to note:
- Adaptive testing. ISC2 says it uses CAT for the CISSP and CCSP exams worldwide. In CAT, the exam adapts to your answers, and ISC2 says each candidate starts with an item well below the passing standard.
- CISSP exam length. ISC2’s announcement of CAT for CISSP in all languages describes a reduced administration time from the six-hour linear format to three hours, with a minimum of 100 items. Older study material still quotes 125 to 175 questions and four hours, which belongs to a previous format. Always check ISC2’s current exam page.
- Peace of Mind Protection. With this option, both attempts must be taken within 180 days of purchase. Check the current price on ISC2’s exam pricing page.
- Scores. ISC2 says it does not release test scores, and candidates who fail receive a per-domain proficiency breakdown at the test center.
- Retakes. The full exam fee is due for each attempt. ISC2’s pages reviewed did not list the waiting periods, so confirm the retake policy before you plan a second attempt.
- Pricing varies by region. The prices above are the standard U.S. prices for the Americas, Asia Pacific, Middle East and Africa. Taxes and currency vary by country.
Cost: One Exam, Both Exams, and Keeping Them Current
| Item | CISSP | CCSP |
| Exam fee | USD 749 | USD 599 |
| Annual maintenance fee | USD 135 | USD 135 |
| CPE required per 3-year cycle | 120 | 90 |
| Path | Exam fees |
| CISSP only | USD 749 |
| CCSP only | USD 599 |
| CISSP and CCSP | USD 1,348 |
Cost points:
- One maintenance fee covers both. ISC2 says members who hold multiple certifications pay one annual maintenance fee, due on their earliest certification anniversary. Holding both does not double the yearly cost.
- CPE is the bigger time cost. CISSP needs 120 credits over three years (suggested 40 per year, with Group A and Group B credit rules), and CCSP needs 90 (suggested 30 per year). ISC2’s member policy page sets the binding requirement as the three-year total, with annual figures as guidance.
- Budget for study too. Training, practice tests and books are separate from exam fees. Our CISSP practice test and CISSP cost guide show typical add-ons.
How Hard Is Each Exam?
ISC2 does not publish pass rates in the pages reviewed, so treat any pass rate you see quoted as unofficial. Think about difficulty in terms of what each exam rewards:
- CISSP difficulty comes from breadth and management thinking. Many questions ask for the best decision from a manager’s point of view, with several technically valid answers. The even domain weights mean weak spots hurt.
- CCSP difficulty comes from cloud depth and shared responsibility. You need to know how security duties split between provider and customer, how data is protected across its life cycle in the cloud, and how legal and compliance rules apply across regions.
- Both are adaptive, so you cannot reliably judge your progress from how many questions you have seen.
If your background is mostly cloud engineering, expect CISSP to feel wide. If your background is mostly general security or audit, expect CCSP to feel specific to platforms and architecture.
CISSP vs CCSP: Which Should You Take?
Take CISSP first if:
- You have five years in two or more security domains, or you will soon.
- You work in or want to move into security management, architecture or consulting.
- Your target job listings ask for CISSP by name, which is common in security leadership roles.
- You want the broadest foundation, and the option to add CCSP cheaply later.
Take CCSP first if:
- Your work is mostly cloud security and you want a credential that matches it.
- You meet the CCSP experience rules (five years of IT, three in cybersecurity and one in a CCSP domain), but you do not have five years across the eight CISSP domains yet.
- You are specializing in cloud security engineering or cloud compliance.
- Your employer or clients ask for CCSP specifically.
Take both, in this order, if:
- You are building toward a senior security architect or cloud security leadership role. Earn the CISSP first, then use it to cover the CCSP experience requirement, and pay for only the CCSP exam.
Consider other credentials if:
- You want a vendor-specific route. Our CCSP vs AWS Security Specialty guide compares the vendor-neutral and vendor-specific options.
- You want a lighter entry point into cloud security. Our CCSK vs CCSP guide covers the Cloud Security Alliance route, and ISC2 allows the CCSK to substitute for one year of CCSP experience.
- You are leaning toward management over technical practice. Our CISSP vs CISM guide compares the two management-oriented credentials.
- You are choosing between security specialties. Our CISSP vs CEH guide and best cybersecurity certifications ranking show where these fit among the others.
Does CCSP Count Toward CISSP?
No, based on ISC2’s pages reviewed. The CCSP page states that an active CISSP can substitute for the entire CCSP experience requirement, but the pages reviewed do not describe the reverse. If you hold the CCSP, you still need the full CISSP experience requirement of five years in two or more domains, less any one-year waiver you qualify for. Check ISC2’s current experience page for the latest waiver list.
A Practical Study Plan
These are suggestions, not ISC2 requirements. Adjust for your background.
For the CISSP
- Download the outline that matches your exam date. Today that is the April 15, 2024 outline, with a newer one reported for April 15, 2027.
- Study all eight domains. The weights run from 10% to 16%, so no domain is safe to skip.
- Practice management-level reasoning. For each scenario, ask what the best first action is for a security manager.
- Take adaptive-style practice sets. Practise reading carefully and committing to an answer, since you cannot depend on seeing a fixed number of questions.
- Plan your experience record early, including which domains each role covered.
For the CCSP
- Download the current outline and confirm it is the one effective August 1, 2026 or later.
- Start with cloud data security. It is reported as the largest domain at 20%.
- Master shared responsibility. Be able to say who is responsible for what in infrastructure, platform and software models.
- Cover legal, risk and compliance. Questions often turn on data location, contracts and audit evidence.
- Note the AI-related additions reported for the 2026 outline, and confirm them against the outline text.
Common Mistakes to Avoid
- Taking the CCSP first when you plan to take both. If you can earn the CISSP first, an active CISSP covers the whole CCSP experience requirement.
- Counting on a waiver without checking. ISC2 updated its CISSP waiver list effective April 1, 2026, and only one year can be waived.
- Studying from an old CISSP format. Material that quotes 125 to 175 questions and four hours is outdated. The CAT format is three hours.
- Using the wrong outline. Check the outline effective on your exam date for both exams.
- Ignoring the Associate path. If you lack the experience, you can pass first and finish the experience over up to six years.
- Paying two maintenance fees. ISC2 says holders of multiple certifications pay one annual fee.
- Skipping CPE planning. CISSP needs 120 credits over three years and CCSP needs 90.
- Assuming fees are final. Prices vary by region and change over time.
FAQS
What is the difference between CISSP and CCSP?
CISSP is a broad security certification across eight domains, from risk management to software development security. CCSP is a cloud security certification across six cloud-focused domains. Both are issued by ISC2.
Should I get CISSP or CCSP first?
Take CISSP first if you want the broad credential and have five years across two or more of its domains. Take CCSP first if your work is cloud security and you meet its experience rules. If you plan to take both, CISSP first lets it cover the CCSP experience requirement.
How much do the CISSP and CCSP exams cost?
The CISSP exam costs USD 749 and the CCSP exam costs USD 599 at standard U.S. pricing for the Americas, Asia Pacific, Middle East and Africa. Prices vary by region.
How much experience do I need for CISSP?
Five years of cumulative, paid work experience in two or more of the eight CISSP domains. A waiver can reduce this by up to one year, depending on ISC2’s current rules.
How much experience do I need for CCSP?
Five years of cumulative, full-time IT experience, with three in cybersecurity and one in one or more of the six CCSP domains. A degree or the CCSK can waive up to one year, and an active CISSP replaces the whole requirement.
Can I take CISSP or CCSP without the experience?
Yes. Pass the exam and become an Associate of ISC2. You then have up to six years to earn the required experience, and associates pay an annual fee of USD 50.
How many questions are on the CISSP and CCSP exams?
Both use computerized adaptive testing. The CCSP exam page lists 100 to 150 items in 3 hours. For the CISSP, ISC2 describes a CAT format with a minimum of 100 items in 3 hours, and third-party reports give up to 150 items. Confirm on ISC2’s page.
Is CISSP harder than CCSP?
They are hard in different ways. CISSP is broader and rewards management-level judgment, while CCSP is narrower and rewards cloud depth and shared responsibility knowledge. ISC2 does not publish pass rates in the pages reviewed.
Does an active CISSP count toward CCSP?
Yes. ISC2’s CCSP experience page says an active CISSP can substitute for the entire CCSP experience requirement.
Do I pay two annual fees if I hold CISSP and CCSP?
No. ISC2 says members with multiple certifications pay one annual maintenance fee of USD 135, due on their earliest certification anniversary.
How many CPE credits do I need for CISSP and CCSP?
CISSP requires 120 CPE credits over a three-year cycle, and CCSP requires 90. ISC2 suggests 40 per year for CISSP and 30 per year for CCSP, but the binding requirement is the three-year total.
Did the CCSP exam change in 2026?
Yes. ISC2’s outline page and June 2026 announcement describe a revised CCSP outline beginning August 1, 2026. Reports describe more AI and machine learning content within the same six domains, so check the outline text.
Is the CCSP worth it if I already have CISSP?
It can be if you work in cloud security, because the CISSP can cover the experience requirement and you pay only the USD 599 exam fee, with no second maintenance fee. Its value depends on your role and employer, so check target job listings before you decide.
Final Thoughts
The choice comes down to scope and sequence. If you want the broad security credential and expect a management or architecture path, CISSP is the foundation. If you work in the cloud every day, CCSP matches the job. If you want both, earn the CISSP first, let it cover the CCSP experience requirement and pay one maintenance fee for both. Check the current exam format, outline and fees on ISC2’s CISSP certification page and the CCSP counterpart before you book, since outlines, experience rules and prices change.
