What the course covers
About this course map
Six domains, mapped one-for-one to the ISC2 CCSP exam outline and taught in the same order, so nothing on the exam is left uncovered.
The outline that defines the current CCSP took effect on 1 August 2026. The six domain names are unchanged, but the content inside them is not: artificial intelligence and machine learning now appear as named topics in their own right, in the architecture domain and again in the data security domain. If you studied CCSP material written before that date, those sections are missing from it.
ISC2 does not publish a percentage weighting per domain for this outline, so the framing line for each domain below says what it is for rather than what share of the paper it takes. Classroom time follows the depth of the content, and the data security and operations domains take the most of it.
Domain 01 — Cloud Concepts, Architecture and Design
The vocabulary and the reference architecture that the other five domains assume you already have.
Domain 02 — Cloud Data Security
The domain that carries the most exam-relevant detail, because data is the thing the cloud actually holds.
Domain 03 — Cloud Platform and Infrastructure Security
Everything beneath the application, including the parts you cannot see and do not control.
Domain 04 — Cloud Application Security
Application security where the platform, the pipeline and the identity layer are all someone else's product.
Domain 05 — Cloud Security Operations
Running the thing once it is live, against a service management discipline rather than ad hoc practice.
Domain 06 — Legal, Risk and Compliance
The domain that decides whether a technically sound cloud design is a usable one.
Who should take this
Cloud and security architects, security engineers working in AWS, Azure or Google Cloud, GRC and audit staff who have to assess cloud estates, and CISSP holders who need the cloud depth their existing certification only gestures at.
ISC2 requires five years of cumulative full-time IT experience, of which three years must be in cybersecurity and one year in one or more of the six CCSP domains. A relevant post-secondary degree or the Cloud Security Alliance CCSK certificate can waive one year, but only one year can be waived in total. An active CISSP satisfies the whole experience requirement. Candidates without it can sit the exam and become an Associate of ISC2 while they accrue the experience.
You will need working knowledge of at least one major cloud platform and of general security practice. You do not need to be a cloud engineer.
The exam
The CCSP is set and awarded by ISC2. It moved from a fixed linear paper to Computerized Adaptive Testing on 1 October 2025, so the questions you see depend on how you answered the ones before.
The exam voucher is purchased separately from ISC2. We arrange it on your behalf and send you the code, and you book your own exam date. Certification also requires endorsement by an existing ISC2 member once you pass.
How we deliver it
Five days, classroom or online live, or at your office for a private group. Roughly a third of the time is spent in live cloud tenancies we own, working through the control decisions each domain describes — key management, logging pipelines, identity federation, provider assurance review — so the domains connect to something you can see.
Mapped to the ISC2 CCSP exam outline effective 1 August 2026, including the artificial intelligence and machine learning content new to that outline. Taught from Hacky Security's own curriculum and cloud estate by instructors who build and run cloud environments for clients.
Exam & certification
- 1Train with us40 hours of instructor-led preparation, labs and practice questions.
- 2Sit the official examExam voucher sold separately. We buy it from the certification body on your behalf and send you the code — you book your own exam date.
- 3Get certifiedThe certification is awarded by ISC2 when you pass their exam.
What you receive
- ISC2 certification — issued by ISC2 after you pass, and verifiable with them.
- Hacky Security certificate of completion — for the training itself, with a unique ID.
- Checkable by employers — anyone can confirm our certificate on the Verify page.
This course is Hacky Security’s own preparation training. The certification itself is awarded by ISC2, not by us.
Similar courses
Independent preparation training delivered from Hacky Security's own curriculum. Hacky Security is not affiliated with or endorsed by the certification body named above. Certification names and codes are the trademarks of their respective owners and are used only to describe what this course prepares you for.
