What changed in the CCSP exam outline (1 August 2026), domain by domain

By Emmanuel Aigbehi Walstra — CISSP, CCSP, CEH, CCSE. Thirty-plus years in cybersecurity, Lead Cloud Security Trainer at TSTC since 2020, more than 10,000 people trained, and author of CCSP Excellence (2024).

ISC2 published a revised CCSP exam outline that applies to exams from 1 August 2026. If you started studying with older material, the obvious question is how much of it still holds.

Short answer: most of it. The six domain names stay the same. Two domains swap one percentage point of weight, and two new subdomains bring artificial intelligence and machine learning into the exam. Under that, many smaller changes add, rename or remove the examples ISC2 lists against each objective.

Below I go through the outline domain by domain and compare it with the previous version, the one effective 1 August 2022. I have stuck to what the two official documents say. Where I give a view on what a change means for your study, I say that it is my view.

The headline changes at a glance

• Same six domains, same names. Cloud Concepts, Architecture and Design; Cloud Data Security; Cloud Platform and Infrastructure Security; Cloud Application Security; Cloud Security Operations; Legal, Risk and Compliance.
• Weights: Cloud Application Security drops from 17% to 16%. Cloud Security Operations rises from 16% to 17%. The other four do not change.
• Two new subdomains: 1.6 Comprehend Artificial Intelligence (AI)/Machine Learning (ML) and 2.9 Comprehend data protection of AI and ML data.
• Item format: the 2026 outline lists the item format as "multiple choice and advanced item types". The 2022 outline listed "multiple choice".
• Exam delivery stays the same: CCSP has used Computerized Adaptive Testing (CAT) since 1 October 2025. That means 100 to 150 items in a maximum of three hours, with a passing grade of 700 out of 1000 points.

ISC2 says the CAT exam is built to match the domain weights in the outline, however many items a candidate gets. A one-point swap will not change much on exam day. What matters more is the new content.

Domain 1: Cloud Concepts, Architecture and Design (17%, unchanged)

The biggest change is the new subdomain 1.6, Comprehend AI/ML. It lists five topics:

• cloud threat detection and analysis
• data source validation and verification
• Security Orchestration, Automation and Response (SOAR)
• ethical concerns
• regulatory requirements

Other edits in Domain 1:

• 1.1: "Key cloud computing characteristics" is now "Essential cloud computing characteristics". The list itself does not change.
• 1.2: DevSecOps is no longer in the list of related technologies. DevOps security is still an objective under 1.4.
• 1.3: "zero trust network" has been removed from the network security examples. Virtualization security now lists isolation. "Common threats" is now "Common cloud threats". Security hygiene now includes immutable architecture and hardening as well as patching and baselining.
• 1.4: Cloud design patterns now include secure by design.
• 1.5: The ISO/IEC 27017 and PCI DSS examples have gone from "verification against criteria". Common Criteria and FIPS 140-2 are still listed as product certifications.

My view: be careful about reading too much into an example that disappears. The "e.g." lists show the kind of thing the exam covers. They are not a complete syllabus. Zero trust is still a mainstream cloud architecture principle, and I would keep studying it.

Domain 2: Cloud Data Security (20%, unchanged)

Domain 2 is still the heaviest domain. It gains the second AI subdomain, 2.9 Comprehend data protection of AI and ML data, which covers:

• data set and model privacy
• data set and model security (e.g., validation, verification)

The smaller changes:

• 2.2: Storage types now include object storage and volume storage, alongside long-term, ephemeral and raw storage.
• 2.3: Hashing now has examples: data integrity and non-repudiation.
• 2.5: "Data labeling" is now "Data labeling and tagging". That fits the way cloud platforms use resource tags for classification and policy.
• 2.7: Legal hold now has examples: authorized access and deletion prevention.

My view: taken together, 1.6 and 2.9 mean you should expect questions on how training data and models are protected, validated and kept private. That is on top of how AI is used for defence. ISC2's separate AI exam guidance for CCSP points to the same areas, such as differential privacy and data remanence on ephemeral AI storage.

Domain 3: Cloud Platform and Infrastructure Security (17%, unchanged)

Domain 3 has the fewest changes:

• 3.1: "Comprehend cloud infrastructure and platform components" is now "Comprehend cloud infrastructure components". The six components listed (physical environment, network and communications, compute, virtualization, storage, management plane) do not change.
• 3.2: "Design resilient" is now "Design resilience", with examples: power, HVAC and connectivity.
• 3.3: "Risk mitigation strategies" is now "Risk treatment strategies". That is the broader term, covering avoid, transfer and accept as well as mitigate.

Business continuity and disaster recovery (3.5) and security controls (3.4) are unchanged.

Domain 4: Cloud Application Security (17% → 16%)

Domain 4 is the domain that loses a point, but it gains a lot of new examples:

• 4.1: Common cloud vulnerabilities now list the OWASP Application Security Verification Standard (ASVS), the OWASP API Security Top 10 and the OWASP Top 10 for Large Language Model Applications, as well as the OWASP Top 10 and SANS Top 25.
• 4.3: Cloud-specific risks now have examples: shared technology issues, CSP insider threats, lack of visibility and control, and legal and jurisdiction issues.
• 4.4: Functional and non-functional testing now mentions CI/CD processes. Testing methods now name SAST and DAST explicitly.
• 4.5: Supply-chain management now lists integrity, authenticity and licensing.
• 4.6: The title is now "Comprehend and apply the specifics of cloud application architecture". Load balancers, Docker and Kubernetes appear in the examples.
• 4.7: "Secrets management" is now "Secrets, key, and certificate management".

My view: although the weight is lower, the new LLM and API references are easy marks to lose. Learn prompt injection, insecure output handling and the API-specific risks well enough to recognise them in a scenario.

Domain 5: Cloud Security Operations (16% → 17%)

Domain 5 gains the point, and you can see where the content was added:

• 5.1: Secure by default is new. "Installation and configuration of management tools" is now "management plane tools".
• 5.2: Single sign-on now appears among the remote access examples, and segmentation among the network security controls. The Infrastructure as Code (IaC) strategy bullet from the 2022 outline is gone from 5.2.
• 5.3: The operational standards in the title used to be ITIL and ISO/IEC 20000-1. They now also include NIST, ISO, HIPAA, COBIT, CIS Controls and COSO.
• 5.6: Log capture and analysis now includes threat intelligence. "Incident management" is now "Incident Response (IR)". Penetration testing is a new topic.

My view: the IaC bullet has gone from Domain 5, but ISC2's AI exam guidance for CCSP still talks about IaC in the Domain 1 context. I would not drop IaC from your study. Penetration testing and incident response in a cloud setting deserve proper time now.

Domain 6: Legal, Risk and Compliance (13%, unchanged)

The weight is the same, but many examples are new:

• 6.1: Forensics requirements now cite CSA guidance and ISO/IEC 27037, 27041, 27042 and 27043. "Legal framework and guidelines" is now "Legal and regulatory frameworks and guidelines".
• 6.2: The title is now "Understand privacy requirements" (it was "issues"). Country-specific legislation now names FERPA, PIPEDA, GDPR, HIPAA and a Digital Personal Data Protection Act.
• 6.3: "Audit process" is now "audit processes". Gap analysis now includes risk and control self-assessment.
• 6.4: The old "data owner/controller vs. data custodian/processor" bullet is now "difference between data roles". The examples are owner, controller, custodian, processor and stewards.
• 6.5: Contract management now includes data ownership and security requirements.

What this means for your study plan

1. Use the 2026 outline as your checklist. Download it from ISC2 and tick off each subdomain, 1.6 and 2.9 in particular.
2. Check your materials. Anything written before mid-2026 can't cover the two AI subdomains. It may still be good for the other 90-plus percent of the content.
3. Practise scenarios as well as definitions. CAT gives you items near your ability level, and you cannot go back and review answers. You need to be able to apply ideas, not just recognise terms.

To check your level now, try our 30 free CCSP practice questions with explanations. If you run CCSP preparation for a team, see how to run internal cloud security training with a ready-made slide deck.

Free samples and study material

Sectutor publishes free CCSP samples: a chapter of the study book, about 50 slides and 30 practice questions. You don't need an email address or an account. If you like the style, the CCSP Kit ($49) has the full 430-page PDF study book and a 600-question offline question bank. There are no videos, classes, labs or exam vouchers, and sales are final, so look at the samples first.