Skip to content
CertGPS
Comparison

ISC2 CC or SSCP: A Year of Experience Apart, and the Associate Route Between Them

CC and SSCP share an issuer, an adaptive format and a two-hour sitting. What separates them is a year of work, and the Associate route lets beginners sit SSCP anyway.

LT
Lisa Thompson
Security Training Director
Published
Updated
Read time
5 min
On this page

Related certifications

Topics

ISC2 CC or SSCP: A Year of Experience Apart, and the Associate Route Between Them

Certified in Cybersecurity (CC) is for people who haven't worked in security yet. The Systems Security Certified Practitioner (SSCP) is for administrators who already run security controls. Both are ISC2 exams of 100 to 125 adaptive items in two hours, $50 apart in price, so what decides it is whether you'll have a year of security work within the next two years. If you will, SSCP is usually the better $249.

CC and SSCP side by side

CCSSCP
IssuerISC2ISC2
FormatComputerized adaptive test; multiple choice and advanced item typesComputerized adaptive test; multiple choice and advanced item types
Questions100 to 125, including 25 unscored pretest items100 to 125, including 25 unscored pretest items
Time2 hours2 hours
Passing standard700 out of 1000, reported as pass or fail700 out of 1000, reported as pass or fail
Price$199 standard registration$249 standard registration
ExperienceNoneOne year full time in one of seven domains; a relevant degree can count as the year
Maintenance$50 a year and 45 CPE credits per three years$135 a year and 60 CPE credits per three years

Who each one fits

CC fits a career changer, a student or a help desk technician who has been handed a few security tasks and wants to know whether the field suits them. ISC2 lists no experience requirement, and CC is approved under the US Defense Department's DoDM 8140.03 manual, which helps if a government contractor is your first employer.

SSCP fits the person one or two years into a job that touches security every day: the systems administrator who provisions accounts and patches servers, the network administrator who writes firewall rules, or the security operations center (SOC) analyst who handles the first stage of an incident. It is also approved under DoDM 8140.03.

If you already have that year, CC adds little. It would confirm vocabulary you use at work and cost you $199 for a credential that sits below the one you qualify for.

The year of experience, and how to sit SSCP without it

ISC2 asks SSCP candidates for one year of full-time work in at least one of the seven domains. Part-time work counts at between 20 and 34 hours a week, with 2,080 part-time hours equal to a year, and paid or unpaid internships count with documentation. A post-secondary degree in computer science, IT or a related field can stand in for the whole year.

Without any of that, you can still pass SSCP and become an Associate of ISC2. The associate pays $50 a year and logs 15 CPE credits a year, then has two years to earn the year of experience and upgrade by paying the $85 difference in fees. That is almost exactly CC's upkeep of $50 a year and 45 credits per three-year cycle. A newcomer who expects to land an IT job soon is choosing between two $50-a-year designations, one of which turns into a full practitioner credential.

The catch is the clock. ISC2 expects the endorsement application before the last day you can hold the Associate designation. You must complete the required year within that two-year window, so finding work near the deadline is not enough. CC has no clock.

What the two outlines test

CC's outline changed on September 1, 2026. Its five domains are now Security Principles (24%), Security Governance (17.3%), Identity and Access Management Concepts (20%), Networking and Cloud Security Concepts (21.3%), and Security Operations and Incident Response (17.3%). The new governance domain asks you to plan GRC work and measure it with key risk indicators, dashboards and scorecards, which is more management vocabulary than CC used to carry.

SSCP's seven domains sit between 9% and 16% each. They go deeper into the tasks themselves: public key infrastructure in the 9% cryptography domain, change management and security awareness in Domain 1, vulnerability management and continuous monitoring in Domain 3, and cloud configuration and mobile device management in Domain 7. Expect questions on how to configure a control, where CC asks what the control is for.

Some ground overlaps. Both outlines now cover cloud security, and both treat AI agents and service accounts as identities that need least privilege. CC holders also arrive knowing the format, since both exams are adaptive and neither lets you go back to change an answer.

What each counts toward

SSCP is on ISC2's list of credentials that waive one of the five years CISSP requires. CC isn't on it, so for anyone heading toward CISSP, only SSCP takes a year off the wait.

Holding both costs no more each year than holding SSCP alone. ISC2 charges members a single $135 fee however many certifications they hold, so CC's $50 fee disappears into it, and Group A CPE credits count toward every active credential whose domains they relate to. For the longer view of this ladder, SSCP vs Associate of ISC2 compares SSCP with the CISSP associate route, and Security+ vs CC covers CompTIA's entry alternative.

Our view

We'd take CC only if you have no IT job and no clear route to one in the next two years, or if it's the cheaper credential an employer or training program asks for. Anyone already in IT, or with a computing degree, should sit SSCP: as a full member if they have the year or an accepted degree, as an associate if they're confident of gaining the experience. A reasonable objection is that a $199 exam with no deadline is a gentler first test than a $249 exam with a two-year clock, and for someone still unsure about security, that's a fair reason to start with CC.

Sources