ExamFinch.com My Study

Study guide

1.3 Eligibility, Experience & Certification Maintenance

Practice this exam

Certified Cloud Security Professional CCSP

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 Current CCSP Exam Facts 1.2 CAT Format, Scoring & Logistics 1.3 Eligibility, Experience & Certification Maintenance

2 Domain 1: Cloud Concepts & Architecture Foundations

2.1 Cloud Computing Concepts (Domain 1.1) 2.2 Cloud Reference Architecture (Domain 1.2) 2.3 Security Concepts Relevant to Cloud (Domain 1.3)

3 Domain 1: Secure Design, CSP Evaluation & AI/ML

3.1 Design Principles of Secure Cloud Computing (Domain 1.4) 3.2 Evaluate Cloud Service Providers (Domain 1.5) 3.3 AI/ML in Cloud Security (Domain 1.6)

4 Domain 2: Data Concepts, Storage & Protection Technologies

4.1 Cloud Data Concepts (Domain 2.1) 4.2 Cloud Data Storage Architectures (Domain 2.2) 4.3 Data Security Technologies & Strategies (Domain 2.3)

5 Domain 2: Discovery, Classification & Information Rights Management

5.1 Data Discovery (Domain 2.4) 5.2 Data Classification (Domain 2.5) 5.3 Information Rights Management (Domain 2.6)

6 Domain 2: Retention, Auditability & AI/ML Data Protection

6.1 Retention, Deletion & Archiving (Domain 2.7) 6.2 Auditability, Traceability & Accountability (Domain 2.8) 6.3 AI/ML Data Protection (Domain 2.9)

7 Domain 3: Infrastructure Components, Data Center & Risks

7.1 Cloud Infrastructure Components (Domain 3.1) 7.2 Secure Data Center Design (Domain 3.2) 7.3 Infrastructure & Platform Risks (Domain 3.3)

8 Domain 3: Security Controls & Business Continuity / Disaster Recovery

8.1 Security Controls Implementation (Domain 3.4) 8.2 Business Continuity & Disaster Recovery (Domain 3.5)

9 Domain 4: Application Security Awareness & Secure SDLC

9.1 Application Security Training & Awareness (Domain 4.1) 9.2 Secure SDLC Process (Domain 4.2) 9.3 Apply Secure SDLC (Domain 4.3)

10 Domain 4: Software Assurance, Architecture & IAM

10.1 Cloud Software Assurance & Validation (Domain 4.4) 10.2 Verified Secure Software (Domain 4.5) 10.3 Cloud Application Architecture (Domain 4.6) 10.4 Identity & Access Management Solutions (Domain 4.7)

11 Domain 5: Build, Operate & Operational Controls

11.1 Build Physical & Logical Infrastructure (Domain 5.1) 11.2 Operate & Maintain Infrastructure (Domain 5.2) 11.3 Operational Controls & Standards (Domain 5.3)

12 Domain 5: Forensics, Stakeholder Communication & Security Operations

12.1 Digital Forensics Support (Domain 5.4) 12.2 Communication with Relevant Parties (Domain 5.5) 12.3 Manage Security Operations (Domain 5.6)

13 Domain 6: Legal Requirements, Privacy & Audit

13.1 Legal Requirements & Cloud Risks (Domain 6.1) 13.2 Privacy Requirements (Domain 6.2) 13.3 Audit Processes for Cloud (Domain 6.3)

14 Domain 6: Enterprise Risk Management & Cloud Contracts

14.1 Cloud Implications for Enterprise Risk (Domain 6.4) 14.2 Outsourcing & Cloud Contract Design (Domain 6.5)

1.3 Eligibility, Experience & Certification Maintenance

Key Takeaways Explain This Topic AI

Full CCSP certification requires at least 5 years cumulative paid full-time IT experience, including 3 years in cybersecurity and 1 year in one or more CCSP domains.

A qualifying degree or CSA’s CCSK can waive up to one year of experience, but only one year total can be waived; an active CISSP substitutes the entire experience requirement.

Candidates who pass without required experience can become an Associate of ISC2 and have six years to earn the five years of required experience.

After certification, CCSP holders pay an Annual Maintenance Fee of USD $135 and maintain the credential on a 3-year CPE cycle.

Study effort should remain proportional to domain weights, with Domain 2 (20%) receiving the heaviest preparation share.

Last updated: July 2026

Why Eligibility Rules Belong in Your Study Plan

Passing the exam is necessary but not sufficient for full CCSP certification. ISC2 gates the credential with paid work experience so the mark represents practiced cloud security competence, not only exam performance. Understanding eligibility early prevents two costly mistakes: delaying the exam when you already qualify, or expecting the certificate the day after a pass when you still need the Associate path.

Baseline Experience Requirement

Candidates must have a minimum of:

  • Five years cumulative, full-time experience in information technology (IT)
  • Of those five years, three years must be in cybersecurity

Of the required experience, one year must be in one or more of the six domains of the current CCSP Exam Outline

Experience is cumulative and must be paid . Part-time work and internships may count under ISC2 rules for accounting experience; review ISC2’s experience-requirements guidance for how to document fractional time. Do not invent hours — document real roles, dates, and domain-aligned duties.

Domain-Year Mapping (Practical View)

The “one year in one or more CCSP domains” requirement is often misunderstood. You do not need one year in each domain. You need at least one year of relevant work that maps to any of the six domains (architecture/design, data security, platform/infrastructure, application security, security operations, or legal/risk/compliance). Many cloud security engineer, cloud architect, GRC-for-cloud, and DevSecOps roles satisfy this if duties clearly touch those domains.

  • Requirement layer Minimum
  • Total paid IT experience 5 years cumulative full-time
  • Cybersecurity portion 3 years within the IT total
  • CCSP domain portion 1 year in ≥1 current outline domain
  • Waivers and Substitutions

ISC2 provides limited ways to reduce or replace experience:

One-Year Waivers (Only One Year Total)

Either of the following may satisfy up to one year of required experience:

  • Earning a post-secondary degree (bachelor’s or master’s) in computer science, IT, or related fields
  • Earning CSA’s Certificate of Cloud Security Knowledge (CCSK)

Critical rule: Only one year of experience can be waived. You cannot stack a degree waiver and a CCSK waiver to remove two years. Choose the path that actually helps your documented timeline, and keep proof (diploma or CCSK certificate) for the endorsement process.

Full Substitution: Active CISSP

An active CISSP credential may be substituted for the entire CCSP experience requirement. This is not a one-year waiver; it is a full substitution. If you already hold CISSP in good standing, you can pursue CCSP without reconstructing a five-year experience narrative for CCSP-specific endorsement (follow current ISC2 process guidance when you apply).

  • Path Effect on experience requirement
  • Qualifying CS/IT-related degree Waive up to 1 year (not stackable beyond one year total)
  • CSA CCSK Waive up to 1 year (same one-year total cap)
  • Active CISSP Substitute entire CCSP experience requirement
  • No waiver / no CISSP Must document full 5 / 3 / 1 experience pattern
  • Associate of ISC2 Path

A candidate who does not yet have the required experience may still sit the exam. After successfully passing CCSP, that candidate may become an Associate of ISC2 . The Associate then has six years to earn the five years of required experience and complete the remaining certification steps.

This path is ideal for strong exam performers who are mid-career switchers or early cloud security specialists. Plan deliberately:

Pass the exam.

Maintain Associate status and track experience carefully.

Align job duties to CCSP domains so the one domain-year is obvious on paper.

Complete endorsement and conversion to full CCSP before the six-year window closes.

Failing to convert within the allowed window wastes a hard-earned pass. Put calendar reminders well before the deadline.

Certification Maintenance: AMF, CPE, and the 3-Year Cycle

Earning CCSP is not a one-time event. ISC2 credentials require ongoing maintenance.

Annual Maintenance Fee (AMF)

For CCSP holders, the Annual Maintenance Fee (AMF) is USD $135 per year . Budget this as a recurring professional cost. AMF amounts can differ by credential and ISC2 publishes AMF overviews; use the CCSP-specific figure when planning.

CPE and the Three-Year Cycle

CCSP is maintained on a three-year certification cycle with Continuing Professional Education (CPE) requirements. In practical terms:

You must earn and report CPEs across the cycle according to ISC2 rules for your credential group.

CPEs can come from professional activities such as training, conferences, teaching, publishing, self-study, and related work — always check current ISC2 CPE guidelines for what is eligible and how to document it.

Non-payment of AMF or failure to meet CPE obligations can put the certification into suspension or other non-good-standing statuses under ISC2 policy.

You do not need to memorize every CPE category for the exam itself, but real-world candidates should treat maintenance as part of total cost of ownership for the credential.

  • Maintenance element CCSP planning figure
  • AMF USD $135 / year
  • Certification cycle 3 years with CPE obligations
  • Experience window (Associate) 6 years to earn 5 years’ experience after pass
  • Study Strategy Proportional to Domain Weights

Eligibility gets you to (or through) the certificate process; domain-weighted study gets you the pass. Revisit the August 1, 2026 weights when building a calendar:

Domain Weight Relative study emphasis

2 Cloud Data Security 20% Heaviest — encryption, keys, lifecycle, discovery, classification, IRM, retention/legal hold, auditability, AI data protection

1 Concepts, Architecture, Design 17% Strong — models, reference architecture, secure design, CSP evaluation, AI/ML security concepts

3 Platform & Infrastructure 17% Strong — components, data center design, risks, controls, BC/DR

5 Security Operations 17% Strong — build/operate, operational standards, forensics, stakeholder communication, SOC/IR

  • 4 Application Security 16% High — training, secure SDLC, assurance, verified software, app architecture, IAM
  • 6 Legal, Risk, Compliance 13% Material — law, privacy, audit, enterprise risk, contracts
  • A Practical Allocation Pattern

If you have 100 focused study hours after foundations:

  • ~20 hours Domain 2
  • ~17 hours each to Domains 1, 3, and 5
  • ~16 hours Domain 4
  • ~13 hours Domain 6

Then use remaining time for mixed CAT-style practice and weak-area remediation. Hours are illustrative, not official ISC2 requirements — ISC2 does not mandate a fixed study-hour total; eligibility is experience-based.

Endorsement Mindset (Beyond the Exam)

After a pass (when seeking full certification), ISC2’s endorsement process requires validation of your experience claims. Write duty descriptions in domain language: data protection decisions, cloud architecture reviews, platform hardening, application security gates, security operations response, or cloud risk/compliance ownership. Vague titles without cloud security substance slow endorsement.

Exam and Career Traps

Trap: Believing a degree and CCSK remove two years. Only one year total can be waived.

Trap: Assuming CISSP is “only one year.” Active CISSP can substitute the entire experience requirement.

Trap: Thinking you cannot sit the exam without five years. You can; you become Associate of ISC2 and have six years to finish experience.

Trap: Ignoring AMF/CPE after the pass celebration — the credential requires maintenance.

Trap: Studying Domain 6 as “only 13%, so skip it.” Contract, privacy, and audit scenarios are high-discrimination items.

Connecting Eligibility to This Guide’s Roadmap

If you already meet experience (or hold CISSP), schedule the exam while domain knowledge is fresh. If you are on the Associate path, still take the exam when prepared — do not wait years “for experience first” if you can pass now and convert later. Either way, allocate study intensity to Domain 2 first , then the 17% cluster, then Domain 4, then Domain 6, while using later chapters to convert outline subtopics into applied cloud security judgment.