Skip to content
CertGPS
Comparison

Security+ or ISC2 CC: Which Entry Certification Fits Where You Are

ISC2 CC is a $199 concepts check for newcomers; Security+ is a $439 exam with hands-on items for people already in IT. How to pick, and whether to hold both.

LT
Lisa Thompson
Security Training Director
Published
Updated
Read time
5 min
On this page

Related certifications

Topics

Security+ or ISC2 CC: Which Entry Certification Fits Where You Are

ISC2's Certified in Cybersecurity (CC) checks that you know the vocabulary of security before anyone pays you to use it. CompTIA writes Security+ for administrators with about two years of hands-on work, and some of its questions are tasks rather than multiple choice. So the choice turns on where you stand today. With no IT job yet, CC, at the $199 ISC2 charges, is the cheaper first test of your interest; if you already work in IT, go to Security+.

The two exams in one table

Security+CC
IssuerCompTIAISC2
FormatMultiple choice and performance-based itemsComputerized adaptive test; multiple choice and advanced item types
QuestionsUp to 90100 to 125, including 25 unscored pretest items
Time90 minutes2 hours
Passing score750 on a 100–900 scale700 out of 1000, reported as pass or fail
Price$439 voucher for SY0-701 (US list)$199 standard registration (Americas, Asia Pacific, Middle East, Africa)
DeliveryPearson VUE test center or OnVUE onlinePearson VUE test centers only
ExperienceNone required; Network+ and two years as a security or systems administrator recommendedNone
RenewalEvery three years: 50 CEUs and a $150 fee$50 a year and 45 CPE credits per three years
Content changeSY0-801 launches November 17, 2026; SY0-701 retires in English June 11, 2027New outline in effect since September 1, 2026

Which one suits your situation

CC was built for people outside IT: career changers, students, and help desk staff who've been handed a few security tasks and want to know if the field suits them. It used to be free. ISC2 closed its One Million Certified in Cybersecurity program to new enrollments on May 20, 2026, and holders of an unexpired code from that program have until December 31, 2026 to use it.

Security+ is for the system administrator, network technician or help desk analyst who already does some security work, and for anyone applying to an analyst job that names it. CompTIA maps it to US Department of Defense 8140 work roles including cyber defense analyst, incident responder and system administrator. CC has its own approval under the DoDM 8140.03 manual, according to ISC2. If a defense contract is your way in, ask which work role you'd fill and check which certifications that role accepts before paying for either.

If subnetting and common ports still trip you up, start with neither. CompTIA recommends Network+ before Security+, and CC's networking domain doesn't go as deep as Security+ will expect.

What each exam makes you do

CC is adaptive. ISC2 explains that it starts below the passing standard and picks each next question so you have roughly an even chance of getting it right, which means it feels hard from start to finish. You can't go back to change an answer, and it stops as soon as the algorithm is 95% confident which side of the pass mark you're on. The rewritten outline covers security principles, governance, identity and access management, networking and cloud, and security operations, with artificial intelligence (AI) written into all five. Its questions stay at the level of concepts, such as what the cloud shared responsibility model leaves to the customer.

Security+ goes further on the same topics and adds tasks. Seven of the 28 objectives in CompTIA's SY0-701 outline begin "Given a scenario", and four of them sit in Security Operations, the largest domain at 28%: securing computing resources, changing firewall and email security settings, setting up identity and access controls, and using log data in an investigation. You're expected to tell a deterrent control from a directive one and know what SPF, DKIM and DMARC each check, which is more detail than CC's outline asks for.

Both syllabuses are in motion this autumn. Most third-party CC material predates the September outline, so ISC2's own courses are the safest match for it. Security+ candidates starting from nothing now will probably end up on SY0-801, which adds threats from AI such as prompt injection and adds passkeys to identity; our SY0-701 vs SY0-801 piece covers that choice.

Holding both, and what each counts toward

For someone already in IT, CC before Security+ mostly means paying twice for overlapping material. The order makes more sense when CC is a cheap check of interest and Security+ follows once a job or a role asks for more.

Security+ is on ISC2's list of credentials that waive one of the five years of experience CISSP requires; CC is not. Security+ also renews when you earn a higher CompTIA certification such as CySA+. CC's natural next step is ISC2's own SSCP, and once you hold an experience-based ISC2 certification you pay a single $135 annual fee for all your ISC2 certifications.

Over a first three-year cycle, using the vendors' list prices, CC costs $349: the $199 exam plus $50 a year. Security+ costs $589: the $439 voucher plus the $150 renewal fee, or less if you renew by passing a higher CompTIA exam instead.

Our view

If you already work in IT, we'd skip CC and put the money toward Security+. Its performance-based items and its place on ISC2's CISSP waiver list make it the more useful credential for anyone who expects to stay in security. CC earns its $199 for someone who doesn't yet know whether they want this career and would rather find out on a short, cheap exam with a structured syllabus. A reasonable counterargument is that CC's adaptive format is good practice for SSCP and CISSP later, which use the same delivery. If you're still deciding where to start, our first security certification guide walks through the wider set of options.

Sources