CCSP vs CISSP: which one should you get?

Every figure below was read off ISC2’s own pages on October 23, 2026, and each is linked to the page it came from.

The two exams side by side

On the day, the two exams feel alike. ISC2’s CCSP exam outline and CISSP exam outline both describe Computerized Adaptive Testing for all exams: 100 to 150 items in 3 hours, multiple choice plus advanced item types, and 700 out of 1000 to pass. If you have prepared for one, you already know how the other is delivered.

ISC2’s pricing page lists standard registration in the Americas at $599 for the CCSP and $749 for the CISSP. The same page lists $50 to reschedule and $100 to cancel. Prices and taxes depend on where you test, so check the page for your region.

What each exam covers

CISSP is the wide one. Its eight domains run from security and risk management, the largest at 16 percent, through identity, networks, operations, and software development, and ISC2 describes it as validating the knowledge to design, engineer, and manage the overall security posture of an organization.

CCSP takes many of the same ideas and applies all of them to the cloud. Its largest domain is cloud data security at 20 percent, and the outline goes into territory CISSP does not reach in the same depth: cloud reference architectures and service models, shared responsibility between the customer and the provider, evaluating cloud service providers, and the legal and compliance questions that come with data living in someone else’s data center. The current outline, effective August 1, 2026, also includes a section on artificial intelligence and machine learning in the cloud.

The experience rules, and why the order matters

Both certifications ask for five years, but not the same five. ISC2’s CISSP experience page asks for 5 years of cumulative, full-time work in 2 or more of the eight CISSP domains. The CCSP experience page asks for 5 years in IT, of which 3 must be in cybersecurity and 1 must be in one or more of the six CCSP domains.

An active CISSP covers all of the CCSP experience. The CCSP experience page says an active CISSP credential may be substituted for the entire CCSP experience requirement. Once you hold CISSP, you do not have to document separate CCSP experience.

CCSP covers one year of the CISSP experience. CCSP is on the approved credential list on the CISSP experience page, which can satisfy 1 year of the 5. The CISSP outline adds that only one year can be waived, so a degree and CCSP together still take off one year, not two.

That asymmetry is why CISSP first is usually the better order: CISSP first saves you the whole CCSP experience requirement, while CCSP first saves you a year at most. Part-time work and internships count toward both, and our CISSP experience requirements guide walks through the part-time math.

You can sit either exam before you have the years. ISC2’s member policies give an Associate of ISC2 up to 6 years to earn the experience for either one. The Associate fee is $50 a year, with an $85 payment when you upgrade to full certification.

What each costs to keep

CCSP asks for fewer credits: 90 per 3 year cycle against 120 for CISSP, per the CPE table in ISC2’s member policies. The fee is where holding both gets cheap. ISC2’s AMF page sets the fee at $135 for either certification and says members pay a single AMF regardless of how many certifications they earn, due on their earliest certification anniversary. Adding CCSP to a CISSP costs no extra annual fee. Our CISSP renewal guide covers Group A and B credits and the grace period in detail.

Outline dates to know

The CCSP outline is new: the current CCSP outline took effect August 1, 2026. The CISSP is about to change: the CISSP outline page says a new outline takes effect April 15, 2027. Match your study material to the outline you will actually sit.

Which one to get

Get CISSP if a posting or contract names it, if your work spans more than the cloud, or if you might want both eventually. Holding it covers the CCSP experience requirement entirely, and the annual fee covers both.

Get CCSP if a requirement names it, or if your job is cloud architecture, engineering, or cloud security operations and a cloud-specific credential says more about your work than a general one. It is also the cheaper exam and asks for fewer credits to keep. If CISSP is the long-term goal, CCSP still takes a year off its experience requirement.

Getting both makes sense for people who run security in cloud-heavy environments, and CISSP first is the efficient order. See the CCSP certification page for where it sits among the other certifications.

FAQ

Going for the cloud credential? The first module of our CCSP course, Cloud Concepts, Architecture and Design, is free. Or, if CISSP comes first, the first module of our CISSP course, Security and Risk Management, is free too.