SOC and incident response analysts have few certifications that test hands-on skill with real tools, and ISACA's Certified Cybersecurity Operations Analyst (CCOA) is one of the newer attempts to fill that gap. Launched in 2025, CCOA sits alongside ISACA's better-known governance, audit and risk certifications. This guide covers who it is for, the exam structure and domain weights, the performance-based questions and the tools they assume, eligibility, fees, CPE renewal and how CCOA compares with other blue team credentials. All facts about the exam, fees and renewal come from ISACA's own pages, checked on 27 October 2026; check current fees before booking.
Key takeaways
- A hybrid, tool-based exam. The four-hour exam combines 115 multiple-choice and 25 performance-based questions, and the performance-based items assume proficiency with Wireshark, Security Onion, Kibana and Linux command-line utilities.
- Detection and response dominate. Incident Detection and Response carries 34% of the weight and Technology Essentials 25%, so this is an analyst exam, not a management one.
- No stated experience requirement. ISACA's certification steps list passing the exam, paying a US $50 application fee, CPE and the Code of Professional Ethics; no years of work experience are listed on the pages checked.
- Clear costs. The exam costs US $399 for ISACA members and US $499 for non-members, plus the application fee and an annual maintenance fee; check current fees.
- Standard ISACA renewal. 20 CPE hours a year and 120 over three years, with a revised CPE policy that requires at least 90 domain-aligned hours per cycle from 1 January 2027.
Who the certification is for
ISACA lists the target audience as cybersecurity analysts, information security analysts, SOC analysts, vulnerability analysts and incident response analysts. In practice CCOA suits three groups:
- Tier 1 and tier 2 SOC analysts who triage alerts, investigate logs and packet captures, and escalate incidents. See the SOC Analyst Career Guide.
- IT and network staff moving into security operations, for whom the Technology Essentials domain (networking, systems, applications) will feel familiar while the detection domain stretches them.
- ISACA-certified professionals (CISA, CISM, CRISC) who want to show technical operations competence alongside governance credentials, for example auditors who review SOC processes.
It is less suitable for experienced incident responders or threat hunters looking for an advanced credential; the domain list covers breadth at analyst level rather than deep forensics or malware reverse engineering.
Exam format and domains
| Item | Detail (ISACA, checked 27 October 2026) |
|---|---|
| Length | Four hours |
| Questions | 115 multiple-choice and 25 performance-based questions |
| Tools assumed in performance-based items | Wireshark, Security Onion, Kibana and Linux command-line utilities, among other open-source tools |
| Delivery | Computer-based, at PSI testing centres worldwide or remotely proctored |
| Scheduling | Registration open continuously; book from 48 hours after payment and up to 90 days ahead; eligibility lasts six months from registration; free rescheduling up to 48 hours before the appointment |
| Passing score | Not stated on the pages checked; ISACA sends results after the exam |
| Domain | Weight | What it covers (exam content outline) |
|---|---|---|
| 1. Technology Essentials | 25% | Cloud and computer networking, devices, ports and protocols, network access and segmentation; databases, command line, containers and virtualisation, operating systems; APIs, automated deployment, cloud applications, scripting |
| 2. Cybersecurity Principles and Risk | 20% | Compliance, governance, risk management, roles, security models; application, cloud, data, network, supply chain, endpoint and web application risk |
| 3. Adversarial Tactics, Techniques, and Procedures | 10% | Attack vectors, threat actors, threat intelligence sources; attack types, attack stages, exploit techniques, penetration testing |
| 4. Incident Detection and Response | 34% | Data analytics, detection use cases, indicators of compromise and attack, logs and alerts, monitoring tools; containment, handling, forensic, malware, network traffic, packet and threat analysis |
| 5. Securing Assets | 11% | Contingency planning, controls, identity and access management, frameworks; vulnerability assessment, identification, remediation and tracking |
One detail to note: the summary on ISACA's outline page shows Securing Assets as 10% while the detailed section shows 11%; the 11% figure is the one that makes the weights add up to 100%. The outline page did not show an effective date, so confirm you are using the current version when you register.
Prerequisites and experience
- Experience: ISACA's "get certified" page lists three steps (pass the exam within the last five years, pay the US $50 application processing fee once scores are released, submit the online application) and does not state a work experience requirement. This differs from CISA, CISM and CRISC, which do require experience.
- Five-year window: candidates must apply for certification within five years of passing the exam.
- Ethics: holders must comply with ISACA's Code of Professional Ethics.
- Practical readiness: although no experience is required, the performance-based items assume you can already filter packet captures, query logs in Kibana and navigate a Linux shell. Candidates without that hands-on time should build a lab first.
Preparation plan
- Baseline against the outline. Score yourself against each topic in the five domains. Most candidates are weakest in either Technology Essentials (if they come from governance) or Incident Detection and Response (if they come from IT operations).
- Build a home lab. Deploy Security Onion with its Kibana-based interface, replay public packet captures, and practise following an alert to the underlying traffic. See the Security Onion Guide and the Wireshark for Security Analysis Guide.
- Practise Linux triage. Reading logs, searching files, checking processes and network connections from the command line, because performance-based items expect it.
- Map adversary behaviour to detections. Use MITRE ATT&CK to connect attack stages to log sources and indicators; Domain 3 is only 10% but underpins the detection questions.
- Revise the identity and vulnerability topics in Domain 5, including how compromised credentials and service accounts appear in logs. See the Detection Engineering for Non-Human Identities Guide.
- Use ISACA's official preparation material listed on the CCOA page, then sit timed practice so you can pace four hours across 140 questions, leaving more time for the performance-based items.
- Book within your six-month eligibility window, aiming for a date that leaves time to reschedule (free up to 48 hours before) if a practice score is weak.
For someone already working in a SOC, six to ten weeks of part-time preparation is a reasonable plan; that is our planning guidance, not an ISACA figure.
Cost, renewal and continuing education
| Item | Amount or rule |
|---|---|
| Exam fee | US $399 (ISACA member), US $499 (non-member) |
| Application processing fee | US $50, one time, after passing |
| Annual maintenance fee | US $45 (member), US $85 (non-member); US $25 and US $50 for a third and later ISACA certification; due by 1 January each year |
| CPE | At least 20 CCOA-related hours each year and 120 over the three-year reporting period |
| CPE from 1 January 2027 | 120 per cycle remains, with at least 90 aligned to the certification's exam content outline and no more than 30 from other professional development; vendor sales demos no longer qualify |
| Audit | Random audits require documentation for a selected year; keep records for 12 months after the end of each three-year cycle; failing an audit results in revocation |
| Reinstatement | Outstanding fees plus US $50 per certification |
Membership can pay for itself if you hold more than one ISACA credential, because of the lower exam and maintenance fees. All amounts were checked on 27 October 2026; check current fees before you book.
Where it fits on the career path
| Credential | Best for | How CCOA compares |
|---|---|---|
| CCOA | Analysts proving hands-on SOC tool skills | Detection-heavy weighting with performance-based items; vendor-neutral, open-source tools |
| CompTIA CySA+ | Analysts wanting a widely recognised intermediate credential | Similar audience; compare current outlines. See the CompTIA CySA+ Guide |
| GIAC GCIH | Incident handlers | More focused on incident handling and attacker techniques. See the GIAC GCIH Guide |
| ISACA CISA, CISM, CRISC | Audit, management and risk roles | Governance rather than operations; CCOA complements them |
- Entry into the SOC: CCOA can follow a foundation credential such as Security+ and come before more specialised GIAC or vendor certifications.
- Next steps after CCOA: specialise into detection engineering, threat hunting or incident response. See the Detection Engineer Career Guide and the Threat Hunter Career Guide.
- Employer view: because CCOA is new, it is less often named in job adverts than long-established analyst credentials. Its value is strongest where an employer already uses ISACA credentials or values the performance-based format.
- Small versus large employers: in a small team, the breadth of Technology Essentials helps an analyst cover networking and cloud; in a large SOC, the detection and response weight matches tier 1 and tier 2 roles directly.
Skills the performance-based items reward
ISACA does not publish the performance-based tasks, so the list below is drawn from the outline topics and the tools ISACA names. Treat it as a practice plan, not a description of real exam items.
| Skill | Outline topic | How to practise |
|---|---|---|
| Filtering and following traffic in a packet capture | Packet analysis, network traffic analysis (Domain 4) | Use Wireshark display filters to isolate a conversation, follow a stream and extract indicators |
| Pivoting from an alert to its evidence | Logs and alerts, monitoring tools (Domain 4) | In Security Onion, move from an alert to related network metadata and full packet data |
| Querying and visualising logs | Data analytics, detection use cases (Domain 4) | Build Kibana queries for failed logins, new services and unusual outbound connections |
| Command-line triage on Linux | Command line, operating systems (Domain 1) | Inspect authentication logs, running processes, listening ports and scheduled tasks |
| Recognising credential misuse | Identity and access management (Domain 5), indicators of compromise (Domain 4) | Trace a service account or API key used from an unexpected host or at an unusual time |
| Prioritising vulnerabilities | Vulnerability management (Domain 5) | Rank scan findings by exposure and known exploitation, then record remediation tracking |
Common mistakes. Studying only from question banks and never touching the tools; spending too long on early multiple-choice items and rushing the performance-based ones; neglecting Technology Essentials because it looks basic, although it carries a quarter of the marks; and leaving the certification application until after the five-year window has nearly run out.
Practitioner checklist
- Read the current CCOA exam content outline and confirm the domain weights before you start studying.
- Score yourself per domain and plan more time for Incident Detection and Response (34%).
- Build a lab with Security Onion, Kibana, Wireshark and a Linux host, and practise end-to-end alert triage.
- Check current fees and decide whether ISACA membership lowers your total cost.
- Book within six months of registration, and use free rescheduling if practice scores are weak.
- Apply for certification promptly after passing; the window is five years.
- Plan 20 CCOA-related CPE hours per year, with most aligned to the outline to meet the 2027 rules.
- Keep CPE evidence for 12 months after each three-year cycle in case of audit.
Standards and references
- ISACA: Certified Cybersecurity Operations Analyst (CCOA)
- ISACA: CCOA Exam Content Outline
- ISACA: Get CCOA Certified
- ISACA: Maintain CCOA Certification
- ISACA: CPE Policy Changes for 2027
- ISACA: How to Earn CPE
Related NHI Mgmt Group resources: Blue Team Certifications Guide · Cybersecurity Certifications Guide · SOC Analyst Career Guide · SOC Guide