CCSK v5 Explained: Domains, Cost and Is It Worth It in 2026?

The CCSK certification is one of the few cloud security credentials you can earn in an afternoon, with no experience requirement, no annual maintenance fee and no expiry date. That combination makes it either the smartest $445 in your training budget or a waste of it, depending entirely on where you are in your career.

Here is the short answer. The Certificate of Cloud Security Knowledge is worth it if you need vendor-neutral cloud security credibility quickly, if you are blocked from CCSP by its five-year experience requirement, or if your employer wants a demonstrable cloud security baseline across a team. It is not worth it if you already hold CCSP, because CCSK covers a subset of the same ground at a lower level of recognition.

This guide covers what changed in CCSK v5, the full domain list, the real exam mechanics, the honest CCSK vs CCSP comparison, and how to prepare for an open book exam that still fails plenty of people.

What Is the CCSK Certification?

The CCSK is issued by the Cloud Security Alliance, the non-profit that publishes the Security Guidance for Cloud Computing and the Cloud Controls Matrix. It launched in 2010 and is widely described as the original vendor-neutral cloud security credential.

Two things make it structurally different from most certifications in this space.

First, it is a certificate rather than a certification in the strict sense. There is no experience requirement, no endorsement process and no code of ethics attestation. You buy an exam token, you sit the exam, you pass, you hold it.

Second, it does not expire. The CCSK requires no continuing professional education credits, no renewal cycle and no annual maintenance fee. Once you hold it, the ongoing cost is zero.

Exam Tip: Because CCSK never expires, the version you hold matters. A CCSK earned against the v4 body of knowledge still shows as valid, but hiring managers increasingly ask which version you sat. If your certificate predates July 2024, it is against the older 14-domain guidance.

The body of knowledge is drawn from three sources: the CSA Security Guidance for Cloud Computing v5, the Cloud Controls Matrix, and ENISA's cloud computing risk assessment. That third source catches people out, because it sits outside the main guidance document.

What Changed in CCSK v5

CSA released CCSK v5 on 16 July 2024, and the v4 exam was withdrawn on 1 January 2026. If you are studying in 2026, v5 is the only version available.

The headline change is structural. The Security Guidance was consolidated from 14 domains down to 12, with related topics grouped rather than scattered. Several v4 domains were merged, and the material was rewritten rather than simply reorganised.

The content changes matter more than the renumbering:

• AI and generative AI replaced the IoT and mobile focus. The v4 guidance devoted a domain to related technologies including IoT and mobile. In v5, artificial intelligence takes that space, covering AI workload security, model risk and the shared responsibility questions that come with managed AI services.
• Zero Trust is now treated as a first-class topic rather than a passing reference, running through the identity, networking and architecture material.
• DevSecOps and application security were substantially expanded, reflecting how cloud security work has shifted left.
• Cloud telemetry and security analytics received far more attention, which is why Security Monitoring is now its own standalone domain rather than a subsection.

CSA also introduced the CCSK Orb, an AI chatbot trained on the body of knowledge, which is bundled with the exam purchase and comes with permanent access.

The practical consequence for study is that most free CCSK material still floating around online was written for v4. If a study guide talks about 14 domains, or spends a chapter on IoT security, it is out of date.

The 12 CCSK v5 Domains

The v5 exam draws from these 12 domains. CSA does not publish fixed percentage weightings per domain in the way CompTIA or ISC2 do, so treat the whole guidance document as fair game.

Domains 1, 5, 9 and 12 tend to carry the most exam weight in practice, because they contain the concepts the other domains keep referring back to. If your study time is limited, front-load those.

CCSK Exam Format and Cost in 2026

The exam mechanics are unusual enough to plan around. It is open book, taken online, and has a pass mark far higher than most security exams.

Exam Tip: The 80 per cent pass mark means you can only afford 12 wrong answers out of 60. That is a much tighter margin than CISSP's 700 out of 1,000 scaled score or Security+ at 750 out of 900, and it is the single biggest reason candidates underestimate this exam.

Two attempts are bundled with the purchase, which softens the risk considerably. You have two years to use them.

The open book format is genuinely open book: you can have the Security Guidance v5, the Cloud Controls Matrix and the ENISA document open in front of you. That is not the advantage it first appears. At 120 minutes for 60 questions you have two minutes per question, and the guidance runs to hundreds of pages. Looking up more than a handful of answers will run you out of clock.

Note that pricing varies by region and by reseller, and CSA occasionally runs promotions, so confirm the current figure at the point of purchase. US veterans can apply for CCSK reimbursement through a dedicated CSA programme.

CCSK vs CCSP: Which Cloud Security Certification Should You Take?

This is the comparison almost everyone researching CCSK actually wants, so here it is in full. The two credentials overlap in subject matter but sit at completely different points in a career.

The experience requirement is usually the deciding factor. CCSP demands five years of cumulative paid IT experience, including three in information security and one in a CCSP domain. Holding CISSP waives the entire requirement. If you cannot meet that bar, CCSK is available to you today and CCSP is not.

The cost picture is also less close than the headline prices suggest. CCSP is $599 per attempt with no second attempt included, plus $135 every year thereafter. Over five years that is roughly $1,274 before any training. CCSK is $445 once, with a spare attempt included, and nothing after that.

Where CCSP wins is recognition. It appears by name in job specifications and in frameworks like DoD 8140 far more often than CCSK does. If your target role lists a required certification, check which one it names before you spend anything.

The sensible sequence for most people is CCSK first, CCSP later. CCSK teaches the vendor-neutral cloud security vocabulary that CCSP assumes you already have, and it does so without a five-year gate. If you are heading that way, our 12-week CCSP study plan covers the step up, and note that the CCSP exam outline changed on 1 August 2026 with new AI and machine learning coverage. If you are weighing CCSP against CISSP instead, we compare them in CISSP vs CCSP.

Is the CCSK Certification Worth It in 2026?

The honest answer depends on which of these groups you fall into.

CCSK is worth it if

• You are blocked from CCSP by experience. This is the strongest case. CCSK gives you a credible, vendor-neutral cloud security credential while you accumulate the years CCSP requires.
• You work in GRC, audit or risk and touch cloud. The Cloud Controls Matrix and the compliance inheritance material map directly onto audit work, and CCSK is the cheapest way to get formally grounded in it.
• You are a security engineer moving into cloud. The vendor-neutral framing is genuinely useful if your background is on-premises, because it teaches the concepts before the AWS or Azure implementation details.
• You need a team-wide baseline. For managers standardising cloud security knowledge across a team, a no-expiry, no-CPE certificate at $445 a head is an efficient way to do it.
• You want the AI security material. The v5 AI content is current and vendor-neutral, which is rarer than it should be.

CCSK is not worth it if

• You already hold CCSP. The overlap is substantial and CCSP is the more recognised credential. Adding CCSK underneath it adds little.
• You need a certification named in a specific job advert or compliance framework. Check the wording first. CCSK appears less often than CCSP, CISSP or the CompTIA stack.
• You have no cloud exposure at all. CCSK assumes a working understanding of security fundamentals such as firewalls, encryption and identity. Complete beginners are usually better served starting with ISC2 CC or CompTIA Security+ and coming back to cloud.

On earnings, treat published figures cautiously. Reported averages for CCSK holders vary widely by source, from around $85,000 to $120,000 or more, and that spread reflects the fact that CCSK holders range from junior analysts to cloud security architects. The certificate itself does not set your salary; the role it helps you reach does. Independent tracking puts CCSK in the mid-range of cloud credentials by hiring demand, well behind CCSP but consistently present in cloud security job adverts.

How to Pass the CCSK Exam

The open book format changes the study strategy completely. You are not memorising, you are building an index.

Read the Security Guidance v5 properly, once. All 12 domains, cover to cover. The goal is not recall, it is knowing where things live so you can find them in under 60 seconds.

Build a lookup index as you read. A simple document mapping topics to page numbers is worth more than any set of flashcards here. Include the Cloud Controls Matrix and the ENISA risk document, because questions do come from both and people forget to index them.

Do not skip ENISA. It is the most commonly neglected source and it is explicitly in scope. Candidates who fail often report ENISA questions as the difference.

Practise under time pressure. Two minutes per question with an 80 per cent pass mark leaves no room for browsing. Work out in advance which five or six topics you would genuinely need to look up, and commit the rest to memory.

Use both attempts deliberately. If your first attempt falls short, you receive feedback on weak areas and the second attempt draws different questions from the pool. Sitting the first attempt slightly early, as a diagnostic, is a legitimate strategy given both are already paid for.

Realistically, an experienced security professional with cloud exposure needs two to three weeks of evening study. Someone new to cloud should plan for six to eight weeks.

If you want structured practice on the underlying cloud security concepts before you sit it, our CCSP practice exam course covers heavily overlapping ground, including identity, data security, and cloud incident response.

Frequently Asked Questions

Is CCSK a good cert?

CCSK is a good certificate for a specific purpose: proving vendor-neutral cloud security knowledge without an experience requirement. It is well regarded within cloud security circles and is backed by the Cloud Security Alliance's widely used guidance. It is less frequently named in job adverts than CCSP or CISSP, so its value is highest as a stepping stone or a team baseline rather than as a headline credential.

Which is better, CCSP or CCSK?

CCSP is the more recognised and more advanced credential, but it requires five years of relevant experience and costs more over time. CCSK has no prerequisites, costs $445 once, and never expires. If you can meet the CCSP experience requirement and your target roles ask for it, take CCSP. If you cannot, take CCSK now and CCSP later.

What is a CCSK certificate?

The CCSK is the Certificate of Cloud Security Knowledge, issued by the Cloud Security Alliance. It tests vendor-neutral cloud security knowledge across 12 domains drawn from the CSA Security Guidance v5, the Cloud Controls Matrix and the ENISA cloud risk assessment. It is a certificate rather than a full certification, meaning there is no experience verification or endorsement step.

How difficult is the CCSK exam?

Harder than its open book format suggests. The 80 per cent pass mark allows only 12 incorrect answers out of 60, and the 120-minute limit means you cannot look up more than a handful of answers. Most candidates who fail do so because they relied on the open book rule instead of learning the material and indexing the sources.

Is the CCSK exam open book?

Yes. You may reference the Security Guidance v5, the Cloud Controls Matrix and the ENISA document during the exam, and it is taken online without a proctor. The time limit is the real constraint, not the material.

Ready to Start Practising?

CCSK rewards people who know the cloud security fundamentals cold and use the open book rule only as a safety net. That comes from repetition, not from reading.

CertCrush gives you exam-realistic practice questions with full explanations across cloud and cloud security certifications, including CCSP, SC-500 and SC-900, so you can find the gaps in your understanding before they cost you 12 marks you cannot spare.

Create your free CertCrush account and start practising today, or browse the full course catalogue to plan your route through cloud security.