ISC2's entry-level Certified in Cybersecurity (CC) changed twice in 2026: a new exam outline took effect on 1 September, and the free One Million Certified in Cybersecurity programme that made it famous is coming to an end. This guide sets out what ISC2 itself publishes about the CC: who it is for, the adaptive exam format, the five domains in the outline effective 1 September 2026, the eligibility rules, fees, and what it costs to keep the credential afterwards. It adds a preparation plan and shows where the CC sits on the path to the SSCP, CISSP and analyst credentials. It is written for career changers, students and early-career IT staff, and for managers who fund entry-level certification. Facts are as published by ISC2 on the pages listed at the end and checked on 24 October 2026; ISC2 changes fees and rules, so confirm before you book.
Key takeaways
- It needs no work experience. ISC2 states that the CC has no work experience requirement; you must be at least 16, pass the exam and agree to the ISC2 Code of Ethics.
- The outline changed on 1 September 2026. The current outline has five domains, including a dedicated Security Governance domain, and ISC2 says it emphasises governance, cloud security and threat intelligence, with AI-related material in each domain. Older study material may not match.
- The exam is adaptive and in person. ISC2 lists 100 to 125 items in two hours, delivered as a Computerized Adaptive Test at Pearson VUE test centres only, with no online proctoring.
- The free route is closing. ISC2 announced in April 2026 that the One Million Certified in Cybersecurity initiative will conclude; its FAQ says holders of a programme code must sit the exam by 31 December 2026. The standard exam fee is USD 199.
- Keeping it is cheap but continuous. CC holders pay a USD 50 annual maintenance fee and earn 45 CPE credits per three-year cycle, with ISC2 suggesting 15 a year.
Who the certification is for
ISC2 positions the CC as its entry-level certification for people starting a cybersecurity career. It is accredited by ANAB against ISO/IEC 17024, the standard for bodies that certify people, and ISC2 lists it as approved under US DoDM 8140.03. Unlike every other ISC2 certification, it has no experience requirement and no endorsement step.
- Good fit: students and graduates, career changers from adjacent fields (IT support, audit, risk, operations), and IT staff who are picking up security duties and need a shared vocabulary for confidentiality, risk, access control and incident response.
- Good fit for employers: a low-cost baseline for new joiners in a SOC, service desk or GRC team, and a first rung for internal talent programmes. See the Cybersecurity Careers Guide.
- Weaker fit: practitioners with a year or more of hands-on security work, who will usually get more from the SSCP or an analyst credential, and anyone who needs to prove practical, tool-level skills. The CC tests concepts, not hands-on tasks.
Small vs large organisations: a small business without a security team can use the CC to give one IT generalist structured security grounding. A large organisation gets more value by making it part of an onboarding curriculum with a defined next step, so the CC does not become the end point.
Exam format and domains
Format
| Item | What ISC2 publishes | ISC2 source |
|---|---|---|
| Current outline | Effective 1 September 2026 | CC exam outline page |
| Format | Variable-length Computerized Adaptive Test (CAT); items are answered in order and you cannot go back to a skipped item | FAQ; CAT page |
| Number of items | 100 to 125, multiple choice and advanced item types | FAQ |
| Maximum time | 2 hours | FAQ |
| Delivery | In person only, at ISC2-authorised Pearson VUE test centres; no online exam | FAQ |
| Languages | English, Simplified Chinese, German, Japanese and Spanish | FAQ |
| Results | Provisional pass or fail at the test centre, confirmed by email; failing candidates receive proficiency levels by domain. ISC2 does not release numerical scores | FAQ |
| Minimum age | 16 | FAQ |
ISC2's CAT page explains that every candidate starts with an item well below the passing standard and that the algorithm re-estimates ability after each answer, using the same content outline as a linear exam. Two practical consequences: the number of items you see says nothing about whether you passed, and because you cannot return to an item, you should answer, commit and move on.
The five domains (outline effective 1 September 2026)
Domain names and subtopics are from ISC2's outline page. The page checked did not list domain weights, so none are given here; check the downloadable outline before you plan study time. The last column is our suggestion for seeing each domain in practice, not part of the outline.
| Domain | Name | Main subtopics in the outline | Where to see it in practice |
|---|---|---|---|
| 1 | Security Principles | Confidentiality, integrity, availability, AAA, non-repudiation and privacy; risk management lifecycle; governance (laws, frameworks, policies, standards, procedures); technical, administrative and physical controls; due care, due diligence and the ISC2 Code of Ethics | NIST Risk Management Framework (SP 800-37) Guide |
| 2 | Security Governance | Planning GRC and its tools; business continuity and disaster recovery; security awareness (culture, social engineering, passwords, phishing); measuring effectiveness with metrics, key risk indicators, dashboards and scorecards | Security Awareness and Human Risk Management Guide |
| 3 | Identity and Access Management (IAM) Concepts | Identity lifecycle (role definition, provisioning, review, deprovisioning); least privilege, separation of duties and access control models | IAM and IGA Basics |
| 4 | Networking and Cloud Security Concepts | OSI and TCP/IP, IPv4 and IPv6, VPNs, firewalls, wireless, embedded systems, ICS and IoT; segmentation, defence in depth and zero trust; cloud characteristics, service and deployment models, shared responsibility | Network Segmentation Guide, Cloud Security Guide |
| 5 | Security Operations and Incident Response | Data handling and encryption; logging, monitoring and event triage; threat actors, cyber threat intelligence and threat frameworks; incident response plans and exercises; asset, configuration and change management; blue, purple and red team testing, application and physical testing | SOC Guide, Incident Response Guide |
ISC2 describes the updated outline as placing more emphasis on governance, cloud security and threat intelligence, and the subtopics now include security metrics and blue, purple and red team testing. ISC2 also adds AI-related narrative to each domain, so expect AI risk and control questions inside existing domains rather than in a separate one.
Where identity fits: Domain 3 is a full domain on identity, and it is where most newcomers first meet provisioning, access reviews and least privilege. Learn these concepts for service accounts, API keys and other non-human identities as well as people: the same lifecycle applies, and it is where many real incidents start. See the Access Reviews Guide.
Prerequisites and experience
| Rule | What ISC2 publishes (checked 24 October 2026) |
|---|---|
| Work experience | None required |
| Age | 16 or older to sit the exam |
| Endorsement | Not required for the CC |
| Ethics | You must agree to the ISC2 Code of Ethics |
| Application deadline | Submit the candidate application within nine months of passing; miss it and you must retake the exam |
| Becoming certified | Pay the first USD 50 annual maintenance fee; the digital badge and certificate are then issued (no mailed welcome kit) |
Because there is no experience gate, the CC carries no Associate route: you are either certified or not. It works best paired with evidence of hands-on work such as labs or a service desk role.
Preparation plan
ISC2 sells official online self-paced training (90 or 180 days of access from purchase) and online instructor-led training (live classes, full-time or part-time, with 180 days of access from the first session), and links an Ultimate Guide to CC, a practice quiz and flash cards on the CC page. The plan below assumes four to six weeks of part-time study for someone with general IT literacy; complete newcomers should allow longer.
- Check your route (week 0): if you hold a One Million Certified in Cybersecurity code, note the 31 December 2026 deadline to sit. Otherwise decide between exam only and Peace of Mind Protection (see the table below).
- Get the current outline (week 0): download the outline effective 1 September 2026 and use its numbered subtopics as your checklist. Reject study material that still shows the older domain names.
- Baseline (week 1): take a short timed quiz across all five domains and record which are weakest.
- Build the concepts (weeks 1 to 3): work domain by domain. For each subtopic write a one-line definition and one real example, for instance a firewall rule for Domain 4 or a joiner-mover-leaver step for Domain 3.
- Make it concrete (week 4): read a real incident response plan template, look at event logs on your own machine, and draw your home network as zones. Concrete examples make scenario questions easier. See the Incident Response Plan Template.
- Cover the new material (week 5): revisit governance metrics, threat intelligence, security testing types and the AI narrative, since these are least covered in older resources.
- Rehearse (week 6): sit at least one full timed mock of 125 items in two hours, without going back to earlier items, to match the CAT rule.
- Book and sit: pick a Pearson VUE slot. You can reschedule up to 48 hours before the exam; it costs USD 50 to reschedule and USD 100 to cancel.
- Apply straight away: submit the candidate application and pay the first AMF soon after a pass, not near the nine-month limit.
Choosing a purchase option
| Option (ISC2 CC page) | Window and attempts | Choose it when |
|---|---|---|
| Exam only | 365-day exam window, one attempt | You are self-funded, confident, and want flexibility on the date |
| Exam with Peace of Mind Protection | Two attempts within 180 days of purchase | You want a safety net and can commit to sitting within six months |
| Training plus exam bundles | Self-paced or instructor-led access with a one-attempt (365-day) or two-attempt (180-day) voucher | Your employer funds training or you want structure |
| One Million Certified in Cybersecurity code | One free attempt; sit by 31 December 2026 (ISC2 FAQ) | You already hold a code: book early, as further attempts need the full fee unless you bought Peace of Mind Protection |
Measuring readiness and value
- Domain spread: practice scores per domain tracked weekly, with no domain well behind the others.
- Completion: application submitted and AMF paid within a month of passing.
- For employers: share of new joiners certified within their first six months, and share who go on to a second credential or role move within two years.
Cost, renewal and continuing education
| Item | Amount or rule (ISC2, checked 24 October 2026) |
|---|---|
| Exam fee | USD 199 (Americas, Asia Pacific, Middle East, Africa and unlisted regions); EUR 191.04 (EMEA); GBP 161.19 (United Kingdom). Prices and taxes depend on where the exam is taken |
| Free exam | One Million Certified in Cybersecurity code holders: one free attempt, sit by 31 December 2026. ISC2 has announced that the initiative will conclude |
| Reschedule or cancel | USD 50 to reschedule, USD 100 to cancel (GBP 35 or 70, EUR 40 or 80) |
| Annual maintenance fee | USD 50, due on the cycle start date and each anniversary |
| CPE per three-year cycle | 45, all Group A |
| Suggested annual CPE | 15 a year |
| Grace period | 90 days after the cycle ends to submit CPE; 90 days from the AMF due date to pay |
| If missed | Suspension (you may not use the CC designation), lasting up to two consecutive years, then termination |
These rules come from ISC2's Certification Maintenance Policy (version 7.0 when checked). The free exam covered the exam itself, not maintenance: the USD 50 AMF applies to everyone who becomes certified. If you later earn another ISC2 certification, check the policy for how fees and CPE combine rather than adding requirements together.
Common failure patterns
- Studying the old outline: resources written before September 2026 use different domain names and miss governance metrics, threat intelligence and testing. Check every book and question bank against the current outline.
- Missing the free deadline: code holders who leave booking late risk losing the free attempt after 31 December 2026, and a failed free attempt means paying the full fee to retry.
- Forgetting the application: passing is not certification. Without the application and first AMF within nine months, the pass lapses and the exam must be retaken.
- Letting the AMF lapse: the free exam did not cover the annual fee, so budget for it. Unpaid AMF leads to suspension after 90 days.
- Treating it as proof of skill: hiring managers who read the CC as hands-on competence will be disappointed; candidates who stop at the CC can stall. Pair it with practical work and a next step.
- Skipping the ethics and governance material: candidates from technical backgrounds often under-revise Domains 1 and 2, which carry code of ethics, due care and metrics questions.
Where it fits on the career path
| Next step | Why it follows the CC | Guide |
|---|---|---|
| SSCP | ISC2's operations credential; needs one year of experience in its domains | SSCP Certification Guide |
| CompTIA Security+ | Another widely used baseline credential with more emphasis on applied scenarios | CompTIA Security+ Guide |
| Analyst and blue team credentials | For those heading into a SOC or incident response role | Blue Team Certifications Guide, CompTIA CySA+ Guide |
| CISSP | The longer-term target for broad and management roles, once experience allows | CISSP Certification Guide |
| GRC track | For those drawn to Domains 1 and 2 | GRC Analyst Career Guide |
ISC2 does not publish pass rates or salary figures on the pages checked, and we do not quote third-party estimates. For how the CC compares with other credentials by level, see the Cybersecurity Certifications Guide, and for the entry route into a SOC, the SOC Analyst Career Guide.
Practitioner checklist
- Confirm you are 16 or older and ready to agree to the ISC2 Code of Ethics; no experience is needed.
- If you hold a One Million Certified in Cybersecurity code, book a sitting before 31 December 2026.
- Download the CC outline effective 1 September 2026 and use its subtopics as your checklist.
- Discard study material that uses the pre-2026 domain names.
- Run a timed baseline across all five domains and study the weakest first, including governance and ethics.
- Rehearse at least one full mock of 125 items in two hours without revisiting items.
- Choose exam only (365 days, one attempt) or Peace of Mind Protection (180 days, two attempts) to suit your timeline.
- Submit the application and pay the USD 50 AMF promptly after passing.
- Diarise the AMF anniversary and log about 15 CPE credits a year.
- Plan your next credential or role move before you sit, so the CC is a first step rather than an end point.
Standards and references
- ISC2: CC Certified in Cybersecurity
- ISC2: CC Certification Exam Outline
- ISC2: Frequently Asked Questions
- ISC2: Computerized Adaptive Testing
- ISC2: Exam Pricing
- ISC2: Member Policies and Certification Maintenance
- ISC2: One Million Certified in Cybersecurity Conclusion
- ISC2: What's New for Entry-Level Cybersecurity
Related NHI Mgmt Group resources: Cybersecurity Certifications Guide · SSCP Certification Guide · CompTIA Security+ Guide · SOC Analyst Career Guide · Cybersecurity Careers Guide