ISC2 CC vs CCSP: entry level or cloud security professional?
ISC2 Certified in Cybersecurity (CC) and Certified Cloud Security Professional (CCSP) sit at opposite ends of the ISC2 range. CC is an entry-level knowledge exam with no experience requirement, built for people starting out in security. CCSP is a professional certification for people who already design, run or assess security in the cloud, and ISC2 requires several years of IT and cybersecurity experience before it awards it. If you are new to security, CC is the right first step. If you already work in security and your work involves cloud services, CCSP is the one that reflects it.
The two exams at a glance
| CCISC2 Certified in Cybersecurity (CC) | CCSPISC2 Certified Cloud Security Professional (CCSP) | |
|---|---|---|
| Vendor | ISC2 | ISC2 |
| Level | Foundational | Professional |
| Questions | 100–125 | 100–150 |
| Time limit | 120 minutes | 180 minutes |
| Passing score | 700 / 1000 | 700 / 1000 |
| Exam fee | $199 | $599 |
| Exam domains | 5 | 6 |
| On SaveMyCert | Fully live | Fully live |
Choose ISC2 CC if…
- You are new to security, with no security job behind you yet.
- You want a credible first credential without an experience requirement.
- You want to learn the vocabulary and domain structure the professional ISC2 certifications build on.
- You are a student or career changer looking for an on-ramp.
Choose CCSP if…
- You already have several years in IT and security, some of it in cloud work.
- Your role involves designing, assessing or operating security for cloud services.
- You advise on cloud contracts, provider assessments, data protection or compliance.
- You hold a CISSP and want a credential that covers cloud specifically.
Two different levels, not two routes to the same place
CC tests whether you know the concepts and the terms: the CIA triad, risk, access control, network basics, incident response. Its questions are short and definitional. CCSP tests whether you can apply security judgement to cloud situations: which party is responsible under a given service model, how to protect data across its lifecycle, how to assess a provider, what an audit report does and does not prove, and how law and contracts change what you can do.
CC is not a prerequisite for CCSP, and passing it does not count towards CCSP’s experience requirement. They are related in the way a first textbook relates to professional practice: CC teaches the language, CCSP assumes you have been working in it.
The experience requirement is the real gate
CC has no work-experience requirement. CCSP does: ISC2 asks for five years of cumulative, full-time IT experience, three of them in cybersecurity and one in one or more of the six CCSP domains. A related degree or the CSA CCSK certificate can each stand in for one year, but only one year can be waived in total. An active CISSP replaces the whole requirement.
You can sit the CCSP exam before you have the experience. A candidate who passes without it becomes an Associate of ISC2 and has six years to earn the five years required. That makes CCSP possible earlier in a career than the requirement suggests, but the full credential still follows the experience.
Both exams are adaptive
Both CC and CCSP are computerised adaptive tests: each question is chosen from your previous answers, and you cannot skip, flag or go back. The difference is in the questions. CC items are mostly direct, and you either know the term or you do not. CCSP items are mostly scenarios in which several options are real controls and one fits the stated situation best, so they take longer to read and reward judgement over recall. The facts table above shows each exam’s length, time limit and pass mark from the ISC2 pages.
- CC:CC study notes · CC cheat sheet · CC practice questions
- CCSP:CCSP study notes · CCSP cheat sheet · CCSP practice questions
Not sure either is the right starting point? Get an ordered certification roadmap for your role and experience.
Sources
Every number in the comparison table above comes from these two exam guides. Vendors revise them, so check the source before making a decision on a figure.