CCSP study plan

Your step-by-step plan

1. Map the six domains and book a date

   Week 1

   Read the current exam outline and the six domains with their weights, paying attention to the fact that the outline changed on 1 August 2026 and now includes the AI and ML subdomains. Book a provisional date now: a fixed date turns open-ended study into a plan and is the strongest predictor of actually sitting.

2. Master the shared responsibility model (Domain 1)

   Weeks 1 to 2

   Start here because the shared responsibility model underpins every other domain. Draw the stack and shade who owns each layer under IaaS, PaaS, and SaaS until it is automatic. Learn the NIST definition, the deployment models, and the provider-assurance programmes, and give the new AI/ML subdomain real attention because older material skips it.

3. Drill the data-protection techniques (Domain 2)

   Weeks 2 to 4

   The largest domain turns on precise vocabulary. Build the table of encryption, tokenisation, masking, anonymisation, and hashing and rehearse which are reversible and which preserve format. Learn the key-custody spectrum (provider-managed, BYOK, HYOK), crypto-shredding for cloud deletion, and how the new AI/ML data subdomain treats training and inference data.

4. Work platform, application, and operations (Domains 3, 4, and 5)

   Weeks 4 to 7

   These three are the technical core and together the largest share of the exam. Drill RTO against RPO, the application-testing methods (SAST, DAST, IAST), the identity protocols, the management plane, and the cloud twist on forensics and operational controls. Practise on scenario questions and read the explanation on every one, including those you got right.

5. Cover legal, risk and compliance (Domain 6)

   Weeks 7 to 8

   The smallest domain but a dense one where subdomains overlap. Nail the controller-versus-processor and owner-versus-custodian roles, the SOC report types and Type I versus Type II, and contractual versus regulated data. Learn the standards by name rather than guessing clause or article numbers.

6. Drill weak domains, then space the review

   Weeks 8 to 10

   Use your per-domain accuracy to attack the domains dragging you down rather than re-reading what you already know. Then space it: revisit each domain's recall prompts after a few days and again a week later. Spacing roughly doubles what sticks compared with cramming.

7. Sit timed mocks and calibrate judgement

   Weeks 10 to 12

   Take full timed mocks to rehearse the best-of-several-defensible-answers judgement and pacing across three hours. Treat the score as a per-domain readiness signal, not a single number, and review every missed question, focusing on why the wrong controls are at the wrong layer or the wrong party.

Frequently asked questions