CCSP vs CISSP: which first, and for whom

By Emmanuel Aigbehi Walstra — CISSP, CCSP, CEH, CCSE. Thirty-plus years in cybersecurity, Lead Cloud Security Trainer at TSTC since 2020, more than 10,000 people trained, and author of CCSP Excellence (2024).

I hold both certifications, and I'm asked this a lot: "Should I do the CISSP or the CCSP first?" The honest answer depends on your role, your experience and where you want to go next. ISC2 has also set things up so that each certification can help with the other, which affects the order.

Below, I compare the two using ISC2's own published information, then give my view on who should take which first. ISC2 changes fees and outlines from time to time, so check every figure on isc2.org before you commit.

The short version

• CISSP covers the whole of information security across eight domains. It suits people who design or lead a security program.
• CCSP goes deep on cloud security across six domains. It suits architects, engineers and GRC staff whose work is mainly in the cloud.
• An active CISSP replaces the entire CCSP experience requirement. In the other direction, CCSP is on ISC2's approved list of credentials that can waive one year of the CISSP experience requirement.

Side-by-side comparison

Exam fees, taxes and currency depend on where you sit the exam. ISC2 publishes regional prices for other areas, including the UK, on its pricing page.

What each exam covers

CISSP (outline effective 15 April 2024) covers Security and Risk Management, Asset Security, Security Architecture and Engineering, Communication and Network Security, Identity and Access Management, Security Assessment and Testing, Security Operations, and Software Development Security. Cloud is part of it, for example cloud-based systems in Domain 3 and acquired cloud services in Domain 8. But cloud is one topic among many.

ISC2 has published a revised CISSP outline that applies from 15 April 2027. Domain 1 becomes "Security Governance and Risk Management", and the weights change. If your CISSP exam date is near that changeover, prepare for the outline that will apply on the day you sit it.

CCSP (outline effective 1 August 2026) covers Cloud Concepts, Architecture and Design; Cloud Data Security; Cloud Platform and Infrastructure Security; Cloud Application Security; Cloud Security Operations; and Legal, Risk and Compliance. It assumes you already know security fundamentals and applies them to cloud. That includes the shared responsibility model, cloud data protection, legal and jurisdictional issues, and, since 2026, AI and ML data protection. My breakdown of what changed in the CCSP outline covers the latest revision.

In my experience teaching both, the CISSP feels broader and the CCSP feels deeper. A CISSP holder sitting the CCSP will find much of the vocabulary familiar. They then have to work through cloud-specific detail that the CISSP only touches on, such as data lifecycle controls, IRM, cloud forensics and contract design.

Experience, endorsement and the Associate route

The two exams work the same way after you pass:

• Endorsement. You must complete the certification application within nine months of your exam date. An ISC2-certified professional in good standing must endorse your experience. If you don't know one, ISC2 can endorse you, but you need proof of employment. Some applications are randomly audited.
• Associate of ISC2. If you pass but don't yet have the required experience, you can become an Associate of ISC2. You then have six years to gain the five years of experience.
• Membership. Once your application is approved, you pay your first annual maintenance fee to become certified.

The experience rules are where the difference shows. For CISSP, the five years must fall within at least two of the eight CISSP domains. For CCSP, you need five years in IT. Three of those years must be in cybersecurity, and one must be in at least one of the six CCSP domains. For either certification, only one year can be waived.

Which first? My view, by profile

These are my recommendations from training both audiences. They are not ISC2 policy.

Take the CISSP first if:

• you lead or plan to lead a security program, or you work across many security disciplines;
• you want the certification that most often appears in general security job requirements, and you meet its experience rules;
• you want the simplest path to CCSP later. An active CISSP removes the CCSP experience requirement entirely, so your second application is straightforward.

Take the CCSP first if:

• your role is mainly cloud: cloud security architect, cloud engineer, cloud GRC or DevSecOps;
• you meet the CCSP experience rules but your experience is concentrated in cloud and spread over fewer than two CISSP domains;
• you want quick, visible proof of cloud skills for your current job. Once you hold the CCSP, it can waive one year of the CISSP experience requirement later.

Consider an alternative first if:

• you're early in your career. ISC2's entry-level Certified in Cybersecurity (CC) has no experience requirement, and passing either the CISSP or CCSP without the experience only makes you an Associate. Both are designed for experienced practitioners.

Maintaining both

If you hold both, ISC2 charges one annual maintenance fee, not two. ISC2 also says CPE credits count towards all the credentials you hold. You still need to meet each certification's minimum: 120 CPE credits per three-year cycle for CISSP and 90 for CCSP, each with its own Group A minimum. ISC2 also advertises that CISSP holders can earn CPE credits for time spent preparing for the CCSP. Check the current maintenance handbook for how to claim them.

Preparing for the CCSP

If you've decided the CCSP comes first or next, start with the six-week CCSP study plan, then test yourself with 30 free CCSP practice questions, and review the core cloud concept in the shared responsibility model cheat sheet. Sectutor's free samples include a chapter of the study book, about 50 slides and a 30-question sample bank, with no email needed. The CCSP Kit ($49) has the full 430-page PDF and a 600-question offline bank. There are no videos, classes, labs or vouchers, and sales are final. Sectutor currently sells CCSP material only. CISSP is listed on the site but not yet for sale.