CCSP is organised into six vendor-neutral domains. This is a plain-English summary with the official weights; the ISC2 exam outline is authoritative. ISC2 has stated it will introduce a revised exam outline from 1 August 2026, so confirm the current version on the ISC2 site before you rely on these weights.
| # | Domain | Weight |
|---|---|---|
| 1 | Cloud Concepts, Architecture and Design | 17% |
| 2 | Cloud Data Security | 20% |
| 3 | Cloud Platform and Infrastructure Security | 17% |
| 4 | Cloud Application Security | 17% |
| 5 | Cloud Security Operations | 16% |
| 6 | Legal, Risk and Compliance | 13% |
Domain 1 - Cloud Concepts, Architecture and Design (17%)
Cloud reference architecture, the shared responsibility model, service models (IaaS, PaaS, SaaS) and deployment models (public, private, hybrid, community), plus secure-design principles and the concepts that the later domains build on.
Domain 2 - Cloud Data Security (20%)
The largest domain. The cloud data lifecycle (create, store, use, share, archive, destroy), data classification and discovery, encryption, tokenization and masking, key management, and data retention, archiving and secure deletion.
Domain 3 - Cloud Platform and Infrastructure Security (17%)
Cloud infrastructure components, risk analysis of the platform, security controls for compute, storage and networking, and business continuity and disaster recovery for cloud workloads.
Domain 4 - Cloud Application Security (17%)
The secure software development lifecycle in the cloud, application security testing (SAST and DAST), identity and access management for applications, and cloud application architecture including APIs and sandboxing.
Domain 5 - Cloud Security Operations (16%)
Operating and managing physical and logical cloud infrastructure, logging, monitoring and SIEM, incident and change management, and communicating with relevant stakeholders.
Domain 6 - Legal, Risk and Compliance (13%)
The smallest domain by weight: legal and regulatory requirements, privacy (including data residency and sovereignty), audit processes and assurance reports, and vendor and supply-chain risk.