Skip to content
CertGPS
News and updates

ISC2's Free CC Program Has Closed: What's Still Free and What CC Costs Now

ISC2 closed One Million Certified in Cybersecurity to new enrollments on May 20, 2026. Who can still sit the CC exam free, until when, and what everyone else pays.

RB
Rachel Brown
Security Researcher
Published
Updated
Read time
3 min
On this page

Related certifications

Topics

ISC2's Free CC Program Has Closed: What's Still Free and What CC Costs Now

Free Certified in Cybersecurity (CC) exams through One Million Certified in Cybersecurity end on December 31, 2026, and only people with an unexpired program code can use that offer. ISC2 stopped enrolling new participants in its One Million Certified in Cybersecurity program on May 20, 2026, after more than a million sign-ups. For anyone starting now, ISC2 charges $199 for the exam in the US.

What the program gave away

From August 2022, according to ISC2's program page, anyone who enrolled got two things free: the CC Online Self-Paced course and one CC exam. The program never covered the annual maintenance fee (AMF). Everyone who passed still filled in the application form and paid $50 a year to hold the credential.

ISC2 announced the end on April 22, 2026 and published its own tally. More than a million people enrolled across 178 countries, more than 570,000 took the course, and more than 65,000 earned CC through the program. Nearly 9,000 went on to a second, more advanced ISC2 certification. ISC2 also says, from its own survey data, that 65% of employed CC holders work in cybersecurity roles and 22% in IT.

Those are cumulative program totals, not a cohort completion study. They don't show how long each participant had to finish, whether course takers intended to sit the exam, or how many participants were still preparing. They should not be presented as a certification pass rate or a settled completion rate.

If you enrolled before May 20

Two things carry over. If you were issued an exam code and it hasn't expired, you can schedule and sit the exam free until December 31, 2026. If your course access hasn't expired, you can keep taking the course. ISC2 doesn't publish one expiry date for every code, so log in and check yours before you plan around the deadline.

Book soon. CC is delivered only at Pearson VUE test centers, and if a December appointment falls through there's no time left to rebook before the deadline. Check which outline your remaining course access covers before relying on it. A new CC outline took effect on September 1, 2026, adding a governance domain, cloud material and threat intelligence. The exam is adaptive: 100 to 125 items in two hours, with a passing standard of 700 out of 1000. If your course access predates the new outline, use the outline itself to fill the gaps, and see the CC study guide for a plan.

What's free now, and what isn't

The exam isn't free for new candidates. ISC2's pricing page lists it at US$199 in the Americas, Asia Pacific, the Middle East and Africa, EUR 191.04 in Europe and GBP 161.19 in the UK. After May 20, ISC2 said, the exam and education became "available for purchase like all ISC2 exams and courses".

One part of the old offer survives in a smaller form. ISC2 Candidate status is still free for the first year, then $50 a year. Its benefits page no longer includes the program's free CC course and exam. It gives you exam preparation webinars, self-study tools, chapter access and 10% off ISC2's Online Self-Paced Training, which runs for 90 or 180 days depending on the package you buy. The training comes with ISC2's education guarantee: fail on your first attempt and you can take the same training again free within a year of finishing it.

After you pass, ISC2's terms are the same as before: you pay the $50 AMF, and you earn 45 continuing professional education credits over each three-year cycle.

Is CC still worth it at $199

Over a three-year cycle the paid route costs $349: the $199 exam plus three $50 fees. That is still cheap for a vendor-neutral credential with no experience requirement, and it remains a reasonable first step for a career changer or student. But without the free exam, the case for CC over a credential with more weight has narrowed. If you already work in IT, compare it against Security+ before paying, and if you have a year of security work, CC against SSCP is the better comparison. If you hold an unused code, use it before December 31.

Sources