Skip to content
CertGPS
Comparison

From ISC2 CC to CCSP: Five Years Between the First Certificate and the Cloud One

ISC2 CC needs no experience and costs $199; CCSP needs five years. What CC's 2026 outline teaches about cloud, and how to spend the years between the two exams.

RA
Robert Anderson
Cloud Security Engineer
Published
Updated
Read time
4 min
On this page

Related certifications

Topics

From ISC2 CC to CCSP: Five Years Between the First Certificate and the Cloud One

Certified in Cybersecurity (CC) asks for no experience and now costs $199. The Certified Cloud Security Professional (CCSP), from the same issuer, asks for five years in IT. CC shortens none of those years. What carries you from one to the other is the work you do in between, and if cloud security is the goal, much of that work can be chosen on purpose.

CC and CCSP on paper

CCCCSP
IssuerISC2ISC2
FormatComputerized adaptive test; multiple choice and advanced item typesSame
Questions100 to 125, including 25 unscored pretest items100 to 150
Time2 hours3 hours
Passing score700 out of 1000, reported as pass or fail700 out of 1000
Price$199 (Americas, Asia Pacific, Middle East, Africa)$599 (Americas)
ExperienceNoneFive years in IT, three in cybersecurity and one in a CCSP domain; an active CISSP covers all of it
Renewal45 CPE credits per three years; $50 annual fee if CC is your only ISC2 certification90 CPE credits per three years; $135 annual fee

Holders of an unexpired code from ISC2's One Million Certified in Cybersecurity program can still sit CC free, but only until December 31, 2026. New enrollments closed on May 20, 2026.

What CC now teaches about cloud

The CC outline in force since September 1, 2026 replaced the old Network Security domain with Networking and Cloud Security Concepts, at 21.3% of the exam. It covers service and deployment models, the shared responsibility model, zero trust and micro-segmentation. ISC2 has also written AI into all five domains, from model poisoning as an integrity problem to AI agents as identities that need least privilege.

That is the same ground CCSP's first domain starts from, at a much shallower depth. CCSP's outline, in force since August 1, 2026, spends 17% on cloud concepts and architecture and then goes where CC never does. Cloud Data Security, at 20%, covers classification, rights management, retention and the audit trail of data events. Legal, Risk and Compliance, at 13%, covers eDiscovery, the scope of audit reports and contract terms such as right to audit. CC asks whether you know what the shared responsibility model is. CCSP asks what your contract with the provider should say about it.

One practical note if you're studying for CC now: McGraw Hill's 2023 All-in-One guide predates the new outline, so check its coverage against the current cloud objectives. ISC2's own CC training follows the current domains.

Spending the years in between

Five years is ISC2's rule, so the plan is about what fills them.

  1. Get the first job, in help desk, administration or junior security work. CC shows interest, and the job is what starts the five-year count. If job postings near you ask for Security+ by name, that matters more than a second entry exam.
  2. After a year in security work, consider SSCP. Unlike CC, it is on ISC2's list of credentials that waive a year of CISSP experience, and its objective 7.4 covers configuring cloud security.
  3. Move toward cloud duties: identity policies, logging, encryption keys, configuration reviews. This is where you earn the year in a CCSP domain. A provider exam such as AWS Security Specialty, Azure Security Engineer or Google Professional Cloud Security Engineer proves the platform skills along the way.
  4. Sit CCSP when the five years line up, three of them in cybersecurity. A relevant degree or the Cloud Security Alliance's CCSK can stand in for one year, but only one in total. If an opportunity comes first, you can pass CCSP early and hold the Associate of ISC2 title for up to six years while the experience builds.

Our cloud security engineer career path describes those middle stages as jobs rather than exams.

Staying with ISC2 the whole way

Keeping CC while you climb costs little. ISC2 charges CC-only members $50 a year. When you earn a second ISC2 certification you pay an $85 upgrade fee, and from then on a single $135 fee covers everything you hold. CC needs 45 credits per three years, all Group A, and ISC2's maintenance handbook says Group A credits count automatically toward each of your active credentials with a relevant domain. Study for SSCP or CCSP that touches CC's domains counts toward CC's 45 as well.

Whether CC is worth keeping once you hold CCSP is another matter. It adds no fee, and it says little about someone five years in.

Our view

If you have an unused free CC code, use it before December 31: the exam is a fair test of the basics, and the new cloud domain is a useful first look. If you'd be paying $199 and already work in IT, we'd put the money toward Security+ or, after a year, SSCP, because both count toward CISSP and CC doesn't. Either way, a job with cloud duties and a provider exam will do more to get you to CCSP than any entry certificate. For a career changer with no IT background, CC is still a reasonable first step at full price. The Security+ vs CC comparison covers that first choice.

Sources