Skip to content
CertGPS
Comparison

SSCP and CCSP: Two Rungs of ISC2's Ladder, With CISSP Usually Between Them

SSCP asks for one year of experience, CCSP for five. How SSCP shortens the route to CCSP through CISSP, and why holding both costs little more than one.

SC
Sarah Chen
Senior Security Consultant
Published
Updated
Read time
4 min
On this page

Related certifications

Topics

SSCP and CCSP: Two Rungs of ISC2's Ladder, With CISSP Usually Between Them

SSCP waives a year of CISSP's experience requirement, and an active CISSP waives all of CCSP's. SSCP on its own does nothing for CCSP. That chain shapes the decision more than the content does: SSCP is ISC2's credential for the administrator a year into security work, CCSP is for the cloud architect five or more years in, and the shortest path between them usually passes through CISSP.

The ISC2 facts for each

SSCPCCSP
IssuerISC2ISC2
FormatComputerized adaptive test; multiple choice and advanced item typesSame
Questions100 to 125, including 25 unscored pretest items100 to 150
Time2 hours3 hours
Passing score700 out of 1000700 out of 1000
Price$249 (Americas, Asia Pacific)$599 (Americas)
ExperienceOne year in one or more of seven domains; a relevant degree can count as the yearFive years in IT, three in cybersecurity and one in a CCSP domain; an active CISSP covers all of it
Without the experienceAssociate of ISC2, with two years to earn the yearAssociate of ISC2, with six years to earn the five
Renewal60 CPE credits per three years90 CPE credits per three years
Annual fee$135, one fee for all ISC2 certifications heldSame

Same exam engine, different jobs

The two exams feel alike on test day. Both are adaptive, both can stop once the engine is 95% confident of your result, after the minimum question count; item and time limits also apply, and neither lets you return to an answered question. What they ask about is very different.

SSCP reads like an administrator's job description: provisioning accounts, reading firewall logs, patching endpoints, handling an incident from detection to recovery. Its seven domains sit between 9% and 16%, and the work is hands-on even though the exam isn't. It suits systems and network administrators and junior security engineers with a year or two behind them.

CCSP is for the person who designs or assesses a cloud environment and has to defend it to auditors and lawyers. Cloud Data Security is its largest domain at 20%, and Legal, Risk and Compliance at 13% covers eDiscovery, audit report scope and contract terms such as right to audit. Since August 1, 2026 its outline also names AI and machine learning in four objectives. Few people with one year of experience could answer those questions from their own work.

Cloud material SSCP already includes

SSCP's objective 7.4, "Understand and configure cloud security", covers virtual private clouds, the shared responsibility model and outsourcing terms such as service-level agreements and data portability, privacy and destruction. Domain 6 adds cloud access security brokers (CASB), and ISC2 has written AI into the outline, treating AI agents and service accounts as identities that need least privilege. An SSCP holder starts CCSP study knowing the vocabulary.

What SSCP covers in one objective, CCSP spreads across six domains. Data location, the types of audit report (SSAE, SOC and ISAE) and the limits of their scope, eDiscovery, and contract terms such as right to audit and escrow all go well beyond SSCP's outline. Expect to spend most of your CCSP study on Domains 2 and 6.

Two routes from SSCP to CCSP

The first goes through CISSP. Because SSCP is on ISC2's list of credentials that waive one of CISSP's five years, an SSCP holder needs four years of work in two of CISSP's eight domains. Once CISSP is active, ISC2 treats CCSP's whole experience requirement as met. This route suits anyone who expects to lead a team or a security program as well as work on cloud. Our CCSP vs CISSP comparison looks at that pairing directly.

The second goes straight to CCSP. You need the full five years, three of them in cybersecurity and one in a CCSP domain, and SSCP doesn't count as a waiver. ISC2 accepts a relevant degree or the Cloud Security Alliance's CCSK for one of those years, but only one in total. This route suits someone who wants to stay in cloud engineering and doesn't need CISSP.

Either way, you can sit CCSP early and hold the Associate of ISC2 title while the years build up.

One membership, overlapping credits

Holding both costs little more than holding one. ISC2 charges a single $135 annual fee however many of its certifications you hold. Its maintenance handbook says Group A credits you submit count automatically toward every active credential with a relevant domain, so a cloud security course can serve SSCP's Domain 7 and CCSP at once. You still need 60 credits for SSCP and 90 for CCSP in their own three-year cycles, and the cycles may not line up.

Our view

For most SSCP holders we'd take the CISSP route: four years of qualifying work in total, CISSP, then CCSP with no further experience requirement. It costs one more exam than going direct, but it leaves you with the broader credential as well as the cloud one. Go straight to CCSP only if cloud is already your job and you're sure you'll stay on the engineering side. And once you hold CCSP, there's little reason to drop SSCP, since the fee is shared and most of the credits overlap. Some would let it lapse anyway, on the view that SSCP reads as a junior credential on a senior CV, and that's a reasonable call.

The ISC2 CC vs SSCP comparison covers the rung below.

Sources