CCSP experience requirements explained
To become an ISC2 Certified Cloud Security Professional (CCSP) you need five years of cumulative, full-time experience in information technology, of which three years must be in cybersecurity and one year in one or more of the six CCSP domains. A related degree or the CSA CCSK certificate can stand in for one of those years, but only one year can be waived in total, and an active CISSP replaces the whole requirement. You do not need the experience to sit the exam: a candidate who passes without it becomes an Associate of ISC2 and has six years to earn it.
The requirement, piece by piece
ISC2 sets the CCSP requirement in three layers, and all three must be met:
- Five years of cumulative, full-time experience in information technology.
- Within those five, three years in cybersecurity.
- Within those, one year in one or more of the six CCSP domains: cloud concepts, architecture and design; cloud data security; cloud platform and infrastructure security; cloud application security; cloud security operations; and legal, risk and compliance.
What can substitute for experience
Three things reduce the requirement. A bachelor’s or master’s degree in computer science, IT or a related field can count for up to one year. The Cloud Security Alliance’s CCSK certificate can count for one year. ISC2 allows only one year to be waived this way, so holding both does not remove two.
An active CISSP is different: it satisfies the entire CCSP experience requirement on its own. That is why many people who already hold the CISSP add the CCSP to cover cloud specifically.
Part-time work and internships can also count. ISC2 publishes guidance on how to calculate them, which is worth reading if your experience is not a simple run of full-time roles.
Passing before you have the experience
You can sit and pass the CCSP exam before you meet the requirement. A candidate who does becomes an Associate of ISC2 and then has six years to gain the five years of experience. Once the experience is in place, the Associate can complete the process and be awarded the full CCSP.
This route suits people who are moving into cloud security and want to take the exam while the material is fresh, rather than wait until the experience is complete.
Preparing for the exam itself
The experience requirement exists because the exam assumes it. CCSP questions are scenarios in which several options are real security controls, and the right one depends on the service model, the responsible party and the stage of the process. Candidates with less experience can still pass, but they need to study the reasoning as well as the facts.
Our CCSP study plan sets out a four-phase approach, and the CCSP study notes, practice questions and mock exams follow the six official domains of the current ISC2 outline.
Original practice questions, timed mock exams and revision notes. No card, nothing to pay.
Questions, answered
Source
Exam details in this post come from the vendor's published exam guide, which is the authority on what is tested and how.