The CCSP exam changes August 1, 2026: what's new and when to test

On August 1, 2026, ISC2's refreshed CCSP exam outline takes effect. Unlike a routine reshuffle of domain weights, this refresh has a clear theme: artificial intelligence security is woven into every one of the six domains. If your exam date lands anywhere near the transition, here is what is changing, what is not, and how to decide when to test.

The CCSP exam today

The current outline, effective since October 1, 2025, structures the exam across six domains: Cloud Concepts, Architecture and Design (17%), Cloud Data Security (20%), Cloud Platform & Infrastructure Security (17%), Cloud Application Security (17%), Cloud Security Operations (16%), and Legal, Risk and Compliance (13%). The exam runs 3 hours with 100 to 150 items, and a passing score of 700 out of 1000. The authoritative reference is ISC2's official CCSP exam outline page, which publishes both the current and the upcoming outline.

What the August 1 refresh adds: AI security, everywhere

Rather than bolting on a new AI domain, ISC2 has threaded AI security topics through the existing six. Per the published outline update, notable additions include:

• Domain 1 (Concepts, Architecture and Design): shared-responsibility models for AI-as-a-Service, and Infrastructure as Code for building resilient AI environments.
• Domain 2 (Data Security): protecting data lakes, homomorphic encryption, and differential privacy for AI pipelines.
• Domain 3 (Platform & Infrastructure): micro-segmentation for isolating ML models and cloud-native hardware security modules.
• Domain 4 (Application Security): secure SDLC for AI applications and defenses against prompt injection.
• Domain 5 (Security Operations): AI-driven threat hunting and monitoring for model drift.
• Domain 6 (Legal, Risk and Compliance): explainability requirements under frameworks such as GDPR.

This mirrors a broader ISC2 move: in April 2026 the organization published AI-focused exam guidance mapping AI concepts across its certification portfolio, and the entry-level CC exam gets its own AI-infused refresh on September 1, 2026. AI content on ISC2 exams is now the norm, not the exception.

Test before or after August 1?

If you are already deep into preparation, test before August 1. You studied against the current outline, the current outline is what your exam will measure, and there is no advantage in re-mapping your knowledge to a new objectives document weeks before test day.

If you are starting now or testing later in 2026, prepare against the new outline from day one. Download the updated outline from ISC2, and check that whatever study materials you buy state they cover the August 2026 objectives. Study materials always lag an outline refresh; a question bank or course that does not mention the new AI topics is measuring you against the old exam.

Either way, your certification itself is unaffected: a CCSP earned on either outline carries the same credential and the same three-year cycle.

How to actually retain the new AI material

The new topics are exactly the kind of content that punishes cramming: precise definitions (differential privacy vs. homomorphic encryption), layered concepts (where prompt-injection defenses sit in an SDLC), and terminology that did not exist in older study guides. Spaced repetition handles this well, because each new concept becomes a card that resurfaces on a schedule until it sticks; our explainer on why spaced repetition beats cramming covers the mechanics.

TierOne Defense Academy's CCSP question bank tracks the current official outline, every question cites a public source, and the AI tutor can unpack any explanation you want to go deeper on. Fifty CCSP questions are free, no credit card, so you can gauge where you stand before the outline changes: see the CCSP prep page.

Not affiliated with or endorsed by ISC2. CCSP is a trademark of ISC2, Inc. Outline details summarized from ISC2's published exam outline, accessed July 2026; the ISC2 page is authoritative if details change.