A 6-week CCSP study plan

By Emmanuel Aigbehi Walstra — CISSP, CCSP, CEH, CCSE. Thirty-plus years in cybersecurity, Lead Cloud Security Trainer at TSTC since 2020, more than 10,000 people trained, and author of CCSP Excellence (2024).

Six weeks is a realistic CCSP timeline for one kind of candidate: someone who already works in security, has hands-on cloud experience, and can protect study time every week. If you are newer to cloud or to security, use the same structure over 10 to 12 weeks. The order of the work matters more than the calendar.

This plan is built around three things: the official ISC2 exam outline, a study book, and plenty of practice questions with honest review. I'll show how to use the free questions on this site and, if you choose, the Sectutor CCSP Kit. You can follow the same structure with any good study material.

Before you start: know what you're preparing for

The CCSP exam outline effective 1 August 2026 has six domains:

The exam uses Computerized Adaptive Testing (CAT): 100 to 150 items, a maximum of three hours, and a passing grade of 700 out of 1000. You can't go back and change an answer once it's submitted. Practise answering each question once and committing, rather than marking it for later.

Download the outline from ISC2 and print it. It's your master checklist. The 2026 version added two subdomains on artificial intelligence and machine learning (1.6 and 2.9), along with many new examples. If any of your materials were written before the 2026 revision, check those parts against the outline and fill the gaps from other sources. I cover the changes in detail in what changed in the CCSP exam outline, domain by domain.

Your study kit

You need four things:

1. The ISC2 outline, used as your checklist.
2. One main study text, so you don't get lost moving between sources. The CCSP Kit ($49) includes a 430-page PDF study book mapped to the six domains. Check its coverage against the 2026 outline as described above.
3. A large bank of practice questions. The CCSP Kit includes a 600-question offline bank. Our 30 free CCSP practice questions with explanations and the 30-question sample on the free samples page are good for a first diagnostic.
4. An error log. This can be a spreadsheet with five columns: question source, domain, what you chose, why it was wrong, and the concept to revisit.

The error log is the part most people skip, and in my experience it's the most valuable. A wrong answer you have written up teaches you more than ten right answers.

Week 0 (two or three days): baseline

• Read the outline once from start to finish. Mark each objective green (I could explain this to a colleague), amber (I've heard of it) or red (new to me).
• Do the 30 free practice questions without notes, then do the 30-question sample bank.
• Log every miss, including lucky guesses.

You now have a map. Your reds and ambers matter more than any generic schedule, including the one below.

Week 1: Domain 1, Cloud Concepts, Architecture and Design

Focus: cloud definitions and roles, the essential characteristics, service categories and deployment models, the reference architecture and shared considerations (portability, interoperability, reversibility), security concepts, secure design principles, evaluating providers, and the new AI/ML subdomain 1.6.

• Read the Domain 1 material in your main text.
• Draw the shared responsibility split for IaaS, PaaS and SaaS from memory. My shared responsibility model cheat sheet gives you a table to check it against.
• Work through the Domain 1 practice questions and log every miss.
• End of week: a mixed set of questions from Domain 1, plus a few from areas you marked red in Week 0.

Week 2: Domain 2, Cloud Data Security

The heaviest domain gets a full week.

Focus: the cloud data lifecycle, storage types and their threats, encryption and key management, hashing, masking and anonymisation, tokenisation, DLP, data discovery and classification, IRM, retention and legal hold, auditability of data events, and the new subdomain 2.9 on AI/ML data.

• Build a one-page comparison: encryption vs tokenisation vs masking vs anonymisation vs hashing. Cover what each protects, whether it can be reversed, and a typical use.
• Write the six lifecycle phases in order and list a control for each phase.
• Work through the Domain 2 questions and keep the error log going.
• End of week: a mixed set covering Domains 1 and 2.

Week 3: Domains 3 and 5, platform, infrastructure and operations

These two domains fit together naturally. Domain 3 covers how infrastructure is designed and protected. Domain 5 covers how it is built, run and monitored.

Focus (Domain 3): infrastructure components, including the management plane; secure data centre design; risk treatment; security controls; and BC/DR with RTO and RPO.

Focus (Domain 5): hardware and virtual hardware security (HSM, TPM, hypervisor types), access and network configuration, OS hardening and patching, operational standards (ITIL, ISO/IEC 20000-1 and the others the outline lists), digital forensics, communication with relevant parties, and security operations, including incident response and penetration testing.

• Make sure you can explain RTO and RPO, and the different BC/DR test types, without notes.
• Read through a cloud incident from first alert to forensic capture. Note what changes when the evidence lives in someone else's data centre.
• End of week: a mixed set covering Domains 1, 2, 3 and 5.

Week 4: Domain 4, Cloud Application Security

Focus: the secure SDLC, threat modelling (STRIDE, DREAD, PASTA, ATASM), testing methods (SAST, DAST, IAST, SCA), supply-chain and open-source assurance, API security, cloud application architecture (WAF, API gateways, containers, orchestration), and IAM: federation, IdPs, SSO, MFA, CASB, and secrets, keys and certificates.

• Learn the OWASP lists the outline names, including the API Top 10 and the Top 10 for LLM Applications, well enough to spot them in a scenario.
• Explain SAML or OIDC federation in plain words: who authenticates, and who trusts whom.
• End of week: a mixed set covering all domains so far, then review the weakest domain in your error log.

Week 5: Domain 6 and consolidation

Focus: conflicting international laws, eDiscovery and forensic standards, privacy requirements and data roles (owner, controller, custodian, processor, steward), audit types and reports (SOC 1/2, Type I/II), enterprise risk management, and contract design (SLA, MSA, SOW, right to audit, escrow, supply chain).

• Domain 6 rewards a manager's point of view. When you are unsure, ask what protects the organisation's legal position and accountability.
• From midweek on, switch to mixed-domain sets. Re-read only the chapters behind your three most frequent error-log themes.

Week 6: Exam conditions and final review

• Early in the week: do one long, timed, mixed session of 100 to 150 questions in one sitting, answering each question once with no going back. You are building stamina and pace, not trying to predict your score.
• Midweek: go through the error log and revisit every concept you have missed twice or more.
• Final days: light review only. Go back over your comparison sheets and the outline checklist, and confirm everything is now green or amber. Sleep matters more than one more chapter.
• Logistics: check your ID matches your registration exactly, confirm your Pearson VUE test centre and arrival time, and read ISC2's exam-day rules. Rescheduling and cancellation carry fees, so decide early if you need to move the date.

Five habits that matter more than the schedule

1. Read the question stem twice. Words like first, best and most decide the answer.
2. Think like an adviser, not a technician. Many CCSP answers favour governance, risk and the business over a technical fix.
3. Remember that the customer stays accountable for its data. The provider can take on responsibility for controls. Accountability for the data stays with the customer.
4. Practise committing. CAT doesn't allow review, so train yourself to make a decision and move on.
5. Expect hard questions. In an adaptive exam, ISC2 says the questions are targeted so you have roughly a 50% chance of answering each one correctly. Feeling uncertain is normal and doesn't mean you are failing.

Try before you buy

Start with the free samples: a chapter of the study book, about 50 slides and the 30-question sample bank, with no email or account needed. If the style suits you, the CCSP Kit gives you the full 430-page book and the 600-question offline bank for $49. There are no videos, classes, labs or exam vouchers, and sales are final, so check the samples first. Team leads who want to run this plan with a group can use the CCSP Slide Deck, which is licensed for internal training.