CySA+ candidates in late 2026 are caught between two exams: CS0-003 retires in English on 22 December 2026, and its successor CS0-004 has been live since 23 June 2026 with different domain weightings. This guide sets out what CompTIA publishes about the Cybersecurity Analyst (CySA+) certification: the exam format, the four domains and their weights in both versions, the recommended experience, retake rules and the three-year continuing education cycle. It adds a version decision, a preparation plan built around analyst tasks rather than memorisation, and where CySA+ sits in a defensive career. It is written for SOC and vulnerability analysts, the managers who fund their training, and Security+ holders deciding what comes next. Facts are as published on comptia.org, checked October 2026; CompTIA changes them, so confirm on the linked pages before you book.
Key takeaways
- CS0-004 is the current version. CySA+ V4 (CS0-004) launched on 23 June 2026; V3 (CS0-003) retires on 22 December 2026 in English and 23 March 2027 in Japanese, Portuguese and Spanish.
- The format is unchanged. Both versions allow a maximum of 85 questions in 165 minutes, with a passing score of 750 on a scale of 100 to 900.
- The weight moves to operations. V4 raises security operations to 34% and incident response to 24%, and cuts vulnerability management from 30% to 26%; it also adds an objective on AI in security operations.
- It is an intermediate, analyst-level credential. CompTIA recommends about four years in a SOC analyst or vulnerability analyst role, though experience is not a hard requirement to sit the exam.
- Renewal costs 60 CEUs or a higher certification. The cycle is three years, with a $150 CE fee if you renew by uploading CEUs; CertMaster CE or a higher-level CompTIA certification also renews it.
Who the certification is for
CySA+ is CompTIA's defensive analyst certification. The V4 page describes it in terms of security operations and vulnerability management roles; it sits above Security+ and alongside PenTest+ in CompTIA's security track.
- Good fit: tier 1 and tier 2 SOC analysts who triage alerts and want a credential that matches the work; vulnerability analysts who run scanners and prioritise remediation; incident responders in smaller teams who also own reporting.
- Good fit for employers: a common, vendor-neutral benchmark for analysts that covers log analysis, threat intelligence, vulnerability prioritisation and incident communication, independent of which SIEM or EDR the team runs.
- Weaker fit: people without basic security grounding (start with the CompTIA Security+ Guide), offensive testers (see the CompTIA PenTest+ Guide), and senior engineers or architects (see the CompTIA SecurityX (CASP+) Guide).
- Public sector and defence: CompTIA's CS0-003 page lists DoD 8140 work roles including cyber defense analyst, cyber defense incident responder, vulnerability assessment analyst, systems security analyst, security control assessor, forensics analyst, cyber defense forensics analyst, cyber crime investigator, all source analyst and warning analyst. The CS0-004 page checked did not list work roles, so confirm the mapping for your role and proficiency level with the hiring organisation.
For the full landscape of security certifications by level and specialism, see the Cybersecurity Certifications Guide. This page covers CySA+ only.
Exam format and domains
Format: V3 and V4 side by side
| Item | CySA+ V3 (CS0-003) | CySA+ V4 (CS0-004) |
|---|---|---|
| Status | Retiring | Current |
| Launch | 6 June 2023 | 23 June 2026 |
| Retirement | 22 December 2026 (English); 23 March 2027 (Japanese, Portuguese, Spanish) | Not listed at the time of checking |
| Questions | Maximum of 85 | Maximum of 85 |
| Question types | Multiple-choice and performance-based | Not listed on the V4 page at the time of checking |
| Duration | 165 minutes | 165 minutes |
| Passing score | 750 on a scale of 100 to 900 | 750 on a scale of 100 to 900 |
| Languages | English, Japanese, Portuguese, Spanish | English; French, Japanese, Spanish and Portuguese listed as coming soon |
| Recommended experience | Network+, Security+ or equivalent knowledge, plus at least four years hands-on as an incident response analyst, SOC analyst or equivalent | About four years in a SOC analyst or vulnerability analyst role |
CompTIA also notes that V3 English learning products retire on 22 November 2026, a month before the exam itself, so new V3 study material becomes harder to buy before the last exam date. At just under two minutes per question, the time limit is more generous than Security+, but performance-based simulations (if your version includes them, as V3 does) still consume a disproportionate share of it.
The four domains and their weightings
| V3 domain (CS0-003) | V3 weight | V4 domain (CS0-004) | V4 weight | Where to see it in practice |
|---|---|---|---|---|
| Security operations | 33% | Security Operations | 34% | SIEM Guide, Threat Hunting Guide |
| Vulnerability management | 30% | Vulnerability Management | 26% | Vulnerability Management Guide |
| Incident response management | 20% | Incident Response and Management | 24% | Incident Response Guide, Digital Forensics (DFIR) Guide |
| Reporting and communication | 17% | Reporting and Communication | 16% | Security Operations Metrics Guide |
Domain names and weights are from CompTIA's V3 and V4 exam pages; the last column is our revision suggestion, not CompTIA content. The domain set is the same, but the balance has shifted: vulnerability management loses four points and incident response gains four. The V4 page also refers to modern, cloud and hybrid environments and includes an objective on AI in security operations covering use cases, risks and governance considerations. Use CompTIA's official exam objectives document for your exact exam code as the revision checklist; it is the only reliable record of what moved.
What the domains mean in daily work
- Security operations: reading endpoint, network, email and authentication logs; recognising indicators of compromise; using threat intelligence; understanding detection tools such as SIEM and EDR and the processes around them. See the SOC Guide and the Detection Engineering Guide.
- Vulnerability management: scanning methods, interpreting scanner output, prioritising by exploitability and asset context rather than score alone, and tracking remediation and compensating controls.
- Incident response: working through the response life cycle from detection to post-incident review, preserving evidence, and knowing when to escalate.
- Reporting and communication: writing findings that a remediation owner or executive can act on, metrics, and stakeholder communication during incidents.
Where identity fits: many analyst investigations turn on accounts. Expect authentication logs, suspicious sign-ins, privilege escalation and credential misuse across the operations and incident response domains, and treat service accounts, API keys and tokens as part of the attack surface when you revise. See the Privileged Access Management Guide and the Credential Dumping Guide.
Which version should you sit?
| Your situation | Suggested version | Reason |
|---|---|---|
| Starting study now | CS0-004 | Current version; no retirement date pressure; material will keep growing |
| Well into CS0-003 study and able to sit by early December 2026 | CS0-003 | Mature material; leaves a short buffer before the 22 December English retirement, but little room for a third attempt |
| Need a Japanese, Portuguese or Spanish exam now | CS0-003, or check CompTIA | V4 translations were listed as coming soon; V3 translations run to 23 March 2027 |
| Failed CS0-003 recently | Usually CS0-004 | A retake after the English retirement date must be on V4, so switching early avoids studying twice |
Prerequisites and experience
There is no mandatory prerequisite. Both versions recommend around four years of hands-on analyst experience, and V3 also recommends Network+ and Security+ or equivalent knowledge. This is a higher bar than Security+, and the exam reflects it: questions assume you can read a log line, a scan result or a packet summary and decide what it means.
- Baseline knowledge: TCP/IP, common ports and protocols, DNS and HTTP behaviour, Windows and Linux process and account basics, and Security+ level concepts. Close these gaps first.
- Tool familiarity: you do not need a particular product, but you should have queried a SIEM, reviewed EDR alerts, run a vulnerability scanner and read its report, and looked at packet captures.
- Without four years: candidates with less experience pass, but should add lab time to compensate: a home SIEM ingesting Windows and Linux logs, an intentionally vulnerable host to scan, and public packet captures to analyse.
Preparation plan
The plan assumes roughly eight to ten hours a week and works with self-study, CompTIA CertMaster products or third-party training.
- Pick the exam code (week 0): use the table above, download the objectives for that code, and confirm every book, course and question bank names the same code.
- Baseline (week 1): sit a timed diagnostic and record a score per domain. Allocate time by domain weight and by gap; security operations alone is about a third of the exam.
- Security operations (weeks 2 to 4): practise log analysis daily. For each indicator in the objectives, find a real example in your SIEM or lab: an encoded PowerShell command line, a beaconing pattern, an impossible-travel sign-in.
- Vulnerability management (weeks 5 to 6): scan a lab, then prioritise ten findings and justify the order using exploitability, exposure and asset value. Write one remediation ticket per finding.
- Incident response and reporting (weeks 7 to 8): walk a scenario end to end: detect, scope, contain, eradicate, recover, review. Write a one-page incident summary for an executive and a technical timeline for the team.
- AI in security operations (V4 only, week 8): cover the objective on AI use cases, risks and governance. The Agentic AI in the SOC Guide is a practical starting point.
- Mixed practice and mocks (weeks 9 to 10): switch to mixed-domain sets, review every wrong answer against the objectives, and sit two full timed mocks of 85 questions in 165 minutes.
- Book and sit (week 11): book early enough that a failed attempt can be retaken on the same version if it matters to you.
If you fail: CompTIA's retake policy sets no wait before a second attempt, but requires at least 14 calendar days before a third or later attempt. Every attempt is charged at full price, with no free retests or retake discounts. Rebuild your plan from the score report's weakest domains.
Small vs large teams: in a small team the candidate may be the only analyst, so pair study with real alert queues and post-incident reviews. Large SOCs can run cohorts, map the domains to their own runbooks and have senior analysts lead one session per domain.
Measuring readiness
- Domain scores: weekly per-domain practice scores, with no domain lagging well behind before booking.
- Timed mocks: full mocks completed inside 165 minutes at or above your target score.
- Applied tasks: number of log, scan and packet analysis exercises completed with a written conclusion.
- Objective coverage: share of sub-objectives you can explain with a work example without notes.
- After certification: CEUs logged against the 60 required, reviewed annually.
Cost, renewal and continuing education
| Item | Rule or amount (as published by CompTIA, checked October 2026) |
|---|---|
| Exam fee | Not shown on the CompTIA exam pages checked; prices vary by region and channel, so check the CompTIA store for your country |
| Retakes | Full price each attempt; no wait before the second; at least 14 calendar days before a third or later attempt |
| Certification cycle | Three years |
| CEUs required | 60 for CySA+ |
| CE fee | $150 per three-year period, due by the expiry date, payable only when renewing by uploading CEUs |
| Fee-free renewal routes | Passing the latest release of the exam, earning a higher-level CompTIA certification, or completing CertMaster CE |
| Multiple certifications | The CE fee is paid only for the highest-level certification held; lower-level ones renew with it |
| Retaking a passed exam | Not allowed on the same exam code without CompTIA's prior consent |
Other CEU sources CompTIA accepts include other CompTIA certifications (partial CEUs), qualifying non-CompTIA certifications, training and higher education, industry participation, publishing and related work experience, with documentation required. For a holder of both Security+ and CySA+, renewing CySA+ is the efficient route because the fee applies only to the highest-level certification.
Common failure patterns
- Using CS0-003 material for CS0-004: the weights differ by up to four points per domain and V4 adds AI in security operations.
- Booking CS0-003 too late: an attempt in mid December 2026 leaves no room for a retake before the English retirement date.
- Memorising instead of analysing: candidates who drill question banks but have never read real logs struggle with scenario questions.
- Treating vulnerability management as scanning: the exam expects prioritisation and remediation tracking, not just knowing scan types.
- Neglecting reporting: the smallest domain still carries about a sixth of the marks, and it is where technical candidates lose easy points.
- Missing the CE deadline: holders who neither log 60 CEUs nor take a renewing route let the certification lapse at the end of the cycle.
Where it fits on the career path
CySA+ is typically taken by analysts two to five years into security work, after Security+ and before senior or specialist credentials.
- Before it: Security+ and an operational role. See the SOC Analyst Career Guide.
- Alternatives at a similar level: the GIAC GSEC Guide covers a broader, more hands-on essentials credential; the Blue Team Certifications Guide compares practical defensive options.
- After it, by specialism: incident handling (see the GIAC GCIH Guide), forensics (see the GIAC GCFA Guide), or architecture (see the CompTIA SecurityX (CASP+) Guide). Earning a higher-level CompTIA certification also renews CySA+.
CompTIA does not publish pass rates or salary figures on the pages checked, and we do not quote third-party estimates. For broader role options, see the Cybersecurity Careers Guide.
Practitioner checklist
- Choose CS0-004 unless you can sit CS0-003 comfortably before 22 December 2026 (English) with room for a retake.
- Download the official exam objectives for your exact exam code and use them as the revision checklist.
- Check that every course, book and question bank names the same exam code.
- Close Security+ level and networking gaps before starting analyst content.
- Practise on real artefacts: SIEM queries, scanner reports, packet captures and incident timelines.
- For V4, cover the AI in security operations objective explicitly.
- Sit at least two timed mocks of 85 questions in 165 minutes before booking.
- Check the current exam price for your country and budget for full price on any retake.
- After passing, diarise the three-year expiry and plan 60 CEUs, CertMaster CE or a higher-level certification.
Standards and references
- CompTIA: CySA+ Certification
- CompTIA: CySA+ V4 (CS0-004)
- CompTIA: CySA+ V3 (CS0-003)
- CompTIA: Earn Continuing Education Units (CEUs)
- CompTIA: Continuing Education Renewal Fees
- CompTIA: Certification Retake Policy
Related NHI Mgmt Group resources: Cybersecurity Certifications Guide · SOC Guide · CompTIA Security+ Guide · GIAC GSEC Guide · SOC Analyst Career Guide