Skip to content
CertGPS

ISC2 Certified in Cybersecurity

Proves you understand core security concepts with no work experience required, on an adaptive exam rewritten in September 2026 with AI topics

EntryISC2

The exam

Exam cost
$199
Study time
2-3 months
Passing score
700 out of 1000
Valid for
3 years

Before you book

  • None; no work experience required

What it covers

Security domains

Career

US pay and outlook from the Bureau of Labor Statistics for the closest BLS occupation to each role this certification fits. BLS doesn't report pay by certification, and counts most of these roles only within a wider occupation, so the figures describe that occupation, not the role or the credential.

Where people with it work

  1. Entry level

  2. Mid level

  3. Senior level

Where it leads

  1. ISC2 Certified in Cybersecurity

    You are here

  2. CompTIA Security+

    Entry

    Next step. Covers similar fundamentals in more depth and adds performance-based questions CC lacks

  3. Systems Security Certified Practitioner

    Intermediate

    Next step. ISC2's next step, adding a one-year experience requirement and hands-on administration topics

Study guide

Last updated

ISC2 CC Study Guide: The 2026 Outline, the $199 Exam and Who Should Bother

Certified in Cybersecurity (CC) is ISC2's entry credential, a check that you know the vocabulary and basic controls of security work before anyone pays you to do it. It asks for no work experience. ISC2 closed its free exam program to new enrollments on May 20, 2026, so the exam now costs $199, and a rewritten outline took effect on September 1, 2026, the first major content change since CC launched in August 2022.

Who CC is for, and who can skip it

CC fits people outside IT who want to test whether security suits them: career changers, students, and help desk staff who've been handed a few security tasks. ISC2 built it for exactly that group, and it's approved under the US Defense Department's DoDM 8140.03 manual, which matters if a government contract is your way in.

If you already administer systems or networks, CC will mostly confirm what you know. Security+ covers similar ground in more depth, and some of its questions are performance-based tasks. With a year of security work behind you, go straight to SSCP, which costs $50 more and requires that year of experience.

Holders of an unexpired exam code from the One Million Certified in Cybersecurity program can still sit for free, but only until December 31, 2026. That sitting will use the new outline.

The CC exam at a glance

FormatComputerized adaptive testing (CAT); multiple choice and advanced item types
Questions100 to 125, including 25 unscored pretest items
Time2 hours
Passing standard700 out of 1000; candidates get pass or fail, not a number
Price$199 standard registration (Americas, Asia Pacific, Middle East, Africa)
DeliveryPearson VUE test centers only, in English, Chinese, Japanese, German or Spanish
PrerequisitesNone
Maintenance$50 annual maintenance fee and 45 CPE credits per three-year cycle
Retakes30, 60, then 90 test-free days; at most four attempts in 12 months

The September 2026 outline, domain by domain

ISC2 renamed four of the five domains and moved every weight:

  • Security Principles, 24% (was 26%)
  • Security Governance, 17.3% (replaces business continuity, disaster recovery and incident response, which was 10%)
  • Identity and Access Management (IAM) Concepts, 20% (was Access Controls Concepts, 22%)
  • Networking and Cloud Security Concepts, 21.3% (was Network Security, 24%)
  • Security Operations and Incident Response, 17.3% (was Security Operations, 18%)

Governance is the big addition. The new Domain 2 asks you to plan governance, risk and compliance work and to measure it with metrics, key risk indicators (KRIs), dashboards and scorecards. Business continuity and disaster recovery shrink to one objective called "understand redundancy." Domain 5 grows the most. It now expects you to know security event triage, threat actors and their motives, cyber threat intelligence, threat frameworks, red, blue and purple teaming, and quantum-resistant cryptography. Cloud is new in Domain 4, from service and deployment models to the shared responsibility model, alongside zero trust and micro-segmentation.

ISC2 has also written artificial intelligence (AI) into all five domains. Its outline names model poisoning as an integrity problem, model drift as a continuity risk, and AI agents as identities that need provisioning and least privilege like any service account.

The format punishes second-guessing. CAT starts below the passing standard and picks each next item so you have roughly a 50% chance of getting it right, which means the exam feels hard all the way through. You can't go back to change an answer, and the test stops once the algorithm is 95% confident which side of the pass point you're on.

How to prepare for the new outline

Most third-party material predates September 2026. The best-known book, Jordan Genung and Steven Bennett's CC Certified in Cybersecurity All-in-One Exam Guide (McGraw Hill, 2023), is organized around the five pre-2026 domains. It's still useful for networking basics and access control models, but it won't teach KRIs, threat frameworks or the shared responsibility model. ISC2 says its own CC Online Self-Paced and Online Instructor-Led training follow the current outline, and it publishes an Exam Guidance for Artificial Intelligence document that maps AI topics to each domain.

A plan for four to six weeks, if you study evenings:

  1. Week one: read the full outline and mark every term you can't explain in a sentence.
  2. Spend about half your time on Domains 1 and 4, which carry 45% of the weight between them. Learn the OSI and TCP/IP models well enough to place a firewall, a VLAN and a VPN on them.
  3. For Domain 2, read the core functions of the NIST Cybersecurity Framework 2.0. Then sketch three KRIs for a small office and what a dashboard of them would show.
  4. For Domain 5, browse MITRE ATT&CK to see what a threat framework looks like. Then walk through one incident response tabletop scenario on paper, from detection to lessons learned.
  5. Use the last week for timed practice in sets of 100 questions in two hours. Most practice tests won't adapt the way CAT does, so judge readiness by the weakest domain, not the average.

Keeping CC, and what comes after it

After you pass, you complete ISC2's application form and pay the $50 annual maintenance fee (AMF) to become a member. CC needs 45 continuing professional education (CPE) credits per three-year cycle, all in Group A; ISC2 suggests earning 15 a year. Miss a deadline and you have a 90-day grace period before suspension.

If you add an experience-based certification later, you pay one AMF of $135 a year for everything you hold. Next steps worth weighing:

  • SSCP once you have a year in security operations, or pass it first and hold the Associate of ISC2 designation while you gain the year.
  • Security+ if job postings in your area ask for it by name.
  • CISSP, years later. CC isn't on ISC2's list of credentials that waive a year of CISSP experience; SSCP and Security+ are.

Our view

CC gives a newcomer a structured syllabus and a recognized result for little money, and it does that well. More than 65,000 people earned it through the free program, according to ISC2, and the 2026 outline is a real improvement, with governance, cloud and threat intelligence where the old version spent a domain on continuity plans. Its weakness is depth. CC tests whether you understand concepts, which says little about whether you can do the work.

At $199 plus $50 a year, a three-year cycle costs $349. That's fair if you're testing your interest or an employer asks for it. If you already work in IT and can afford one exam, we'd put the money toward Security+ or SSCP instead.

Sources