ISC2 Certified in Cybersecurity: Exam, Cost & Career Guide

ISC2 launched the Certified in Cybersecurity (CC) in 2022 as a zero-cost, no-experience-required entry point into the profession, and it has since become one of the most-registered credentials for individuals pursuing a cybersecurity career change, whether aiming for a cybersecurity analyst role or switching to cybersecurity from IT. The exam covers five domains in a two-hour window, no degree, no prior IT job, and no vendor background required to sit for it.

However, the free-exam promotion that made CC famous has shifted more than once, and vouchers, retake rules, and annual membership fees have changed alongside it, so the real cost of holding this credential isn't always what a quick search suggests, and understanding the broader landscape of certification vs. bootcamp costs can clarify your investment.

That gap between marketing and fine print is exactly where most candidates get tripped up before they ever book a testing appointment.

Credential Snapshot: ISC2 CC at a Glance

Five exam domains, 100 to 125 adaptive questions, and a two-hour testing window define the ISC2 Certified in Cybersecurity (CC), an entry-level credential issued by ISC2. The table below provides a quick-reference followed by notes on the current exam outline and promotional status.

Quick-Reference Table

• Issuing body: ISC2
• Exam code: CC¹
• Exam format: Computer Adaptive Testing (CAT)
• Question count: 100 to 125²
• Time limit: 120 minutes²
• Passing score: 700 out of 1,000²
• Exam fee: $199¹
• Delivery: Pearson VUE test centers or online proctoring¹
• Certification validity: 3 years¹
• Annual Maintenance Fee (AMF): $50 per year¹
• CPE requirement: 45 credits over the 3-year cycle¹
• Domains: 5 (Security Principles 26%², Network Security 24%², Access Controls Concepts 22%², Security Operations 18%², Business Continuity, Disaster Recovery and Incident Response 10%²)

Updated Exam Outline Coming September 2026

ISC2 has announced that a revised CC exam outline takes effect on September 1, 2026.² If you are scheduling your exam around that date, check the official exam outline page to confirm which version you will sit for. Domain weights and topic coverage could shift, so aligning your study materials with the correct outline version matters.

One Million Certified in Cybersecurity Program Status

ISC2's One Million Certified in Cybersecurity (1MCC) program, which offered free self-paced training and a complimentary exam voucher, closed enrollment on May 20, 2026.⁴ Vouchers issued before that date remain valid through December 31, 2026.⁴ If you enrolled before the cutoff, you can still redeem your voucher at no cost. Everyone else should plan on the standard $199 exam fee.

Use this snapshot to budget your time, money, and study effort as you explore the sections ahead.

What ISC2 Certified in Cybersecurity Validates

The CC credential is designed to signal that you grasp the core concepts of cybersecurity, not that you can configure a firewall on your first day. It's a starting point, and understanding exactly what it proves will help you decide if it's the right launchpad for your career or a stepping stone toward more advanced cybersecurity certifications.

The Five Exam Domains and Their Weighting

The ISC2 CC exam breaks down into five domains, each representing a specific chunk of foundational knowledge. The approximate weight of each domain on the test is set by ISC2 and guides your study priorities:

• Security Principles (25%): Covers confidentiality, integrity, availability, risk management concepts, and security governance basics.
• Business Continuity, Disaster Recovery, and Incident Response Concepts (15%): Focuses on preparedness planning, business impact analysis, and the fundamentals of responding to disruptions.
• Access Controls Concepts (20%): Addresses physical and logical access controls, authentication methods, and the principle of least privilege.
• Network Security (20%): Examines network defense, common attack types, secure network architecture, and related protocols at a conceptual level.
• Security Operations (20%): Looks at data security, system hardening, logging and monitoring, and operational security practices.

What Competency the CC Actually Proves

The CC validates foundational, vendor-neutral knowledge. It demonstrates that you understand the language of cybersecurity, the fundamental principles that protect systems and data, and the roles and responsibilities within a security team. It is not a hands-on technical exam; you won't be configuring devices or writing incident response scripts. ISC2 positions the CC as the entry point to its certification family, sitting well below the CISSP, which requires years of professional experience and covers managerial and strategic depth. Think of CC as proving you can walk into a security conversation and follow along, not lead it.

Gateway to ISC2 Membership and the Associate Pathway

Passing the CC exam does more than add a credential to your resume. It automatically grants you ISC2 membership, with all the associated benefits: access to local chapters, professional networking events, continuing education resources, and the ISC2 community. More importantly, for newcomers without the work experience required for CISSP, the CC makes you eligible for the ISC2 Associate pathway. As an Associate of ISC2, you can work toward the experience requirements for a full certification while already being recognized, which is a meaningful edge when you're starting out.

How the CC Overlaps With Security+

If you've researched entry-level cybersecurity certifications, you've likely encountered CompTIA Security+. The domain topics are similar: risk, access control, network security, and operations. The key differences lie in depth and vendor-neutrality emphasis. Security+ demands more technical detail and is recognized globally as a broader IT security baseline, often tied to government job requirements. The CC, on the other hand, stays firmly at the conceptual level, explicitly avoids vendor-specific tie-ins, and is closely woven into the ISC2 membership ecosystem. For someone targeting an eventual CISSP, the CC can feel like a natural first step; for a role that needs immediate technical hands-on validation, Security+ might be the more practical choice.

Who Values the CC in the Real World

Employers who sponsor ISC2 certifications or hire for entry-level cybersecurity roles are beginning to take note of the CC, though it is still newer than established alternatives. Its greatest immediate value is often as a differentiator for applicants to internships, help desk security roles, or junior SOC analyst positions. Pairing the CC with any form of hands-on home lab practice or an IT fundamentals badge creates a much stronger signal than the credential alone. For career changers with no prior tech role, the CC demonstrates serious intent and provides a structured vocabulary to discuss security concepts with interviewers who may hold CISSP themselves.

Who Should Pursue the CC, and Who Should Not

Is the ISC2 Certified in Cybersecurity credential worth your time, or is it a better move to skip straight to something like Security+ or CISSP? The answer depends almost entirely on where you are in your career. Here is a breakdown by learner profile, with an honest verdict for each.

Career Changer with No IT Background

If you have never worked in technology and are exploring cybersecurity for the first time, the CC can serve as a structured introduction to core security concepts. It carries a lower technical barrier than CompTIA Security+, and the availability of the free cybersecurity learning path 2026 (including ISC2's free training) makes it a low-risk entry point. However, employers do not yet recognize the CC as widely as the comptia security+ career path, so it is rarely a standalone hiring signal. To get value, pair it with home-lab practice, networking fundamentals, and a plan to pursue a more recognized credential within 12 months. - Verdict: CC is a strong first step when paired with hands-on labs and self-study.

Early IT Professional (Helpdesk, Sysadmin, Network Support)

If you already have one to three years in a technical support role, the CC adds cybersecurity vocabulary quickly and confirms a baseline understanding of security operations. It is especially efficient if you intend to sit for the CISSP once you accumulate the required experience, because CC holders become ISC2 members and start earning CPE credits immediately. The main limitation is that Security+ remains the more requested credential in government and enterprise job postings, so you may need both. - Verdict: Adds cybersecurity vocabulary quickly; best value if CISSP is within 2-3 years.

Working Cybersecurity Practitioner

If you already hold a security operations, SOC analyst, or GRC role, the CC adds virtually nothing to your resume. Recruiters and hiring managers in the field will not view it as a differentiator. Your time and money are better spent on a role-aligned certification such as CISSP (for broad managerial validation), CySA+ (for blue team analysis), or a cloud security specialist credential. - Verdict: CC adds little value; pursue CISSP, CySA+, or a specialty cert instead.

Experienced Specialist or Manager

With five-plus years in cybersecurity or IT management, the CC is a step backward. This credential is designed for newcomers and early-career professionals. If you need a credential to validate your experience for a promotion or job change, target advanced certifications like CISSP, CISM, or vendor-specific expert credentials. Taking the CC would duplicate effort without advancing your career. - Verdict: Not worth the time; target CISSP, CISM, or domain-specific credentials.

Overall, the CC makes the most sense for profiles 1 and 2: those who need a guided entry point or a quick credibility boost along Cybersecurity Certification Roadmaps. For working practitioners and experienced specialists, it is an unnecessary detour.

Questions to Ask Yourself

Eligibility, Prerequisites, and Recommended Experience

The ISC2 Certified in Cybersecurity (CC) has no formal prerequisites: you don't need a specific degree, prior certification, or any professional cybersecurity experience to sit for the exam. That makes the CC one of the most accessible entry-level cybersecurity credentials available today, much like other cybersecurity certifications without a degree. Unlike the CISSP, which mandates five years of cumulative, paid, full-time work experience in at least two of the eight domains, the CC is explicitly designed for people starting from zero. ISC2 does not impose an experience requirement, an endorsement process, or a prerequisite exam. Anyone can register, prepare, and take the test.

Recommended Knowledge for a Smoother Start

Although the exam has no official barriers, ISC2 acknowledges that candidates come from diverse backgrounds. If you are completely new to technology, you'll benefit from building a few foundational skills before you open the official study materials. Specifically, you should be comfortable with:

• Basic networking concepts: Understanding what an IP address is, how DNS works, and the purpose of common protocols like TCP and HTTP.
• Operating system familiarity: Navigating file systems, user accounts, and basic command-line tasks on Windows or Linux.
• IT terminology: Knowing terms such as firewall, encryption, authentication, and patch management.

These are not hard requirements, but they will help you move through the study material without getting stuck on core IT vocabulary.

Free Official Training Bridges the Gap for Beginners

ISC2 offers free cybersecurity training through a free, self-paced online course called "Certified in Cybersecurity" that is designed specifically for people with no cybersecurity background. The course covers all five exam domains at an introductory level, using bite-sized modules, videos, and knowledge checks. It serves as a complete study resource for many learners, and taking it is strongly recommended for anyone who doesn't yet feel confident with IT fundamentals. The material is available on ISC2's website and does not require a paid membership to access.

How CC's Entry Point Differs from CISSP (and Why It Matters)

Newcomers often confuse the CC with the CISSP because both are issued by ISC2. However, the CC is a foundation credential that tests broad, conceptual knowledge of security principles; it does not attempt to validate deep hands-on expertise. The CISSP, by contrast, requires proof of extensive professional experience and is an advanced management-level certification. The CC acts as a stepping stone into the ISC2 ecosystem, allowing you to become an ISC2 candidate (and later an associate) without meeting the rigorous experience gates that block many beginners from pursuing the CISSP. For someone with no IT work history, the CC removes the biggest obstacle to becoming a cybersecurity professional: proving you've already done the job.

Full Cost Breakdown: Exam, Training, Retakes, and Renewal Fees

The total cost of earning and maintaining your ISC2 Certified in Cybersecurity credential depends on several variables, including whether you qualify for promotional pricing, use free or paid training, and how you handle annual maintenance. Because ISC2 periodically adjusts fees, promotional offers, and the status of its One Million Certified in Cybersecurity (1MCC) program, always verify current pricing directly at isc2.org before budgeting. The figures below represent approximate cost categories rather than guaranteed amounts. Check with your employer, school, or professional association for reimbursement programs, scholarships, or member discounts that could reduce your out-of-pocket spend.

Exam Format, Scoring, Testing Options, and Retake Policy

The tradeoff here is speed versus certainty: the CC exam is short and free on your first attempt, but the format itself (linear delivery, scaled scoring, in-person only) means you can't casually walk in and treat it as a low-stakes practice run. Understanding the mechanics before you schedule saves you weeks of retake waiting and, if you fail, the full exam fee on your second attempt.

Format and Scoring

The CC uses linear delivery with 100 multiple-choice questions and a two-hour time limit.¹ Unlike ISC2's flagship CISSP exam, the CC is not currently a Computerized Adaptive Test (CAT), so every candidate answers the same fixed number of questions regardless of performance mid-exam.

Scoring is scaled, not a raw percentage. You need 700 out of 1000 to pass, but that 700 is a scaled score, not "70% correct." ISC2 does not publish the exact number of correct answers required, because different question forms carry different weights. Treat 700 scaled as roughly aligning with strong performance across all five domains rather than a simple pass mark you can calculate on the fly.

Delivery Options and Languages

CC is delivered exclusively at Pearson VUE test centers. Remote online proctoring (OnVUE) is not available for this exam; unlike certifications with online cybersecurity exam proctoring, the CC requires you to visit a Pearson VUE test center. The exam is offered in English, Chinese, German, Japanese, Korean, and Spanish.

Book two to four weeks ahead in major metros, longer in smaller markets. Bring two forms of ID (one government-issued photo ID). Expect standard test-center protocols: lockers for personal items, no notes, palm-vein or photo check-in, and a short pre-exam tutorial that does not count against your two hours.

Retake Policy

ISC2's retake waits are tiered and enforced strictly:

• After a first failed attempt: 30-day wait before you can retest.
• After a second failed attempt: 60-day wait.
• After a third failed attempt: 90-day wait.
• Annual cap: Maximum of four attempts per rolling 12 months.³

The first attempt is free⁴ under ISC2's current entry-level promotion, but every retake is billed at the full standard exam fee.¹ That single detail changes the calculus: a rushed first attempt is not "free practice," because failing it puts your next try behind a paywall and a month-long clock.

How to Prepare: Domain-By-Domain Study Plan and Resources

How long does it take to prepare for the ISC2 Certified in Cybersecurity exam, and what study sequence actually works? Most successful candidates report six to eight weeks of focused study, dedicating roughly 40 to 60 total hours depending on prior background. The key, as our how to prepare for cybersecurity certification guide outlines, is front-loading effort on the highest-weighted domains while building conceptual momentum toward exam day.

Recommended Six to Eight Week Study Sequence

Structure your preparation around domain weight, starting with the areas that carry the most exam questions:

• Weeks 1-2: Security Principles (26% weight, 10-12 hours): Begin here because foundational concepts like confidentiality, integrity, availability, and risk management vocabulary appear throughout other domains. Study tip: create a glossary of key terms and write one-sentence definitions in your own words rather than memorizing textbook language.

• Weeks 2-3: Access Controls Concepts (22% weight, 8-10 hours): Focus on authentication factors, authorization models, and the principle of least privilege. Study tip: diagram the differences between discretionary, mandatory, and role-based access control models, then map real-world examples to each.

• Weeks 3-4: Network Security (24% weight, 10-12 hours): This domain covers protocols, firewalls, and common attack types. Study tip: draw out the OSI model and map specific attacks to their relevant layers, such as ARP spoofing at Layer 2 versus DNS poisoning at Layer 7.

• Weeks 4-5: Security Operations (18% weight, 8-10 hours): Incident response, logging, and monitoring are central here. Study tip: walk through incident response scenario simulations, narrating each phase from identification through lessons learned.

• Week 5-6: Business Continuity, Disaster Recovery, and Incident Response Concepts (10% weight, 4-6 hours): These overlap with Security Operations but emphasize planning and recovery. Study tip: compare recovery time objectives versus recovery point objectives and practice calculating acceptable downtime for hypothetical scenarios.

• Weeks 6-8: Review, Practice Exams, and Gap Analysis: Dedicate the final stretch to comprehensive review and timed practice tests.

Tiered Resource Recommendations

Not all study materials are equal, and mixing resource types builds stronger retention:

• Tier 1 (Free, Official): ISC2 offers free self-paced training through their official CC course portal. This should be your baseline resource because it aligns directly with exam objectives.

• Tier 2 (Structured Learning): The Coursera ISC2 CC specialization provides video lectures, quizzes, and a certificate of completion. It works well for learners who benefit from scheduled pacing and instructor guidance.

• Tier 3 (Books and Study Guides): The official ISC2 Certified in Cybersecurity study guide and Sybex publications offer deeper explanations and end-of-chapter review questions. Use these to fill conceptual gaps after working through video content.

• Tier 4 (Hands-On Labs): For hands-on cybersecurity labs, platforms like TryHackMe and CyberDefenders provide interactive environments for conceptual reinforcement. Even though the CC exam is not highly technical, walking through basic security scenarios builds intuition.

• Tier 5 (Practice Exams): Boson, Pocket Prep, and official ISC2 practice tests are essential for exam readiness. Use these to simulate testing conditions and identify weak domains.

Practice Exam Strategy and Exam Readiness

Before scheduling your exam appointment, aim to score 80 percent or higher consistently on timed practice tests. This buffer accounts for the adaptive format, which adjusts question difficulty based on your performance and makes the actual exam feel less predictable than a static question bank.

One critical warning: review the cybersecurity exam ethics and brain dumps guidance and avoid memorized question banks. The adaptive testing mechanism means that questions vary by candidate, and memorizing specific answers from leaked materials provides false confidence. Worse, ISC2 actively investigates candidates who use such materials, and violations can result in permanent certification bans.

Focus on understanding why answers are correct rather than pattern-matching to specific question wording. When you miss a practice question, spend time reviewing the underlying concept rather than simply noting the right letter.

Related Articles

Jobs, Salary Outlook, and Employer Demand for CC Holders

The ISC2 Certified in Cybersecurity credential is designed as a gateway into the profession, and employer demand reflects that positioning. As of 2025 and 2026, hundreds of active job postings in the U.S. (and a comparable number globally) list the CC as an accepted or preferred certification. However, CC nearly always appears alongside other baseline credentials such as CompTIA Security+, GIAC GISF, or even CISSP, rather than as a standalone requirement. That means the CC opens doors, but it rarely unlocks them by itself. According to the U.S. Bureau of Labor Statistics, the broader Information Security Analysts occupation (SOC 15-1212) employed roughly 179,430 professionals nationally, with a median annual wage of $124,910. Entry-level roles where the CC is most commonly cited will typically fall closer to the 25th-percentile mark or below the national median, especially for candidates with fewer than two years of experience.

Cybersecurity Salaries by State

Geography plays a major role in information security analyst compensation. The table below shows median and mean annual salaries across all 50 states, the District of Columbia, and Puerto Rico, based on the most recent Occupational Employment and Wage Statistics data from the U.S. Bureau of Labor Statistics (2024). States with large federal or defense contractor footprints, such as Virginia and Maryland, and major tech hubs like California and Washington tend to top the list.

Renewal, CPE Requirements, and Maintenance Timeline

The CC is not a one-and-done credential: keeping it active requires ongoing continuing professional education (CPE) credits and an annual maintenance fee paid to ISC2. Miss either obligation and the certification lapses, so treat renewal as a recurring calendar item from the day you pass the exam.

Where to Find the Official Rules

ISC2 sets and updates the specific CPE totals, submission categories, and audit procedures for every credential it issues, including the CC. Rather than trust secondhand summaries, use a Cybersecurity Certification Finder to locate the latest requirements directly from the official credential sources before you plan your renewal cycle:

• ISC2 member portal: Once you certify, your dashboard shows your current CPE balance, your cycle end date, and the annual maintenance fee status. This is the definitive record.
• ISC2 CPE Handbook: Published on isc2.org, this document lists which activities qualify (webinars, conferences, chapter meetings, volunteer work, self-study, teaching, published writing), how many credits each activity is worth, and what proof you need to keep on file.
• ISC2 Bylaws and Code of Ethics: Renewal isn't just credits. You are also reaffirming ISC2's ethical canons each cycle, and violations can end the credential faster than an expired CPE balance.

Building Your Own Maintenance Plan

Because credit values and category caps do get revised, the practical move is to verify current requirements at the start of every cycle rather than assume last year's numbers still apply. A few habits that make the process painless:

• Log CPEs in the portal as you earn them, not in a year-end scramble. Attach the certificate, agenda, or confirmation email at the same time.
• Diversify activity types. Relying entirely on one category (say, self-study podcasts) can bump into per-category caps that ISC2 sets to encourage varied professional development.
• Set a calendar reminder for the annual maintenance fee. A lapsed fee suspends the credential even if your CPE balance is healthy.

Cross-Checking Industry Norms

For context on how CC renewal compares with adjacent credentials, professional associations like CompTIA, ISACA, and (ISC)2 chapters all publish their own maintenance rules. Our Compare Cybersecurity Certifications Side by Side resource lets you view those rules side by side, making it easier to build a single CPE calendar that feeds multiple certifications at once, the real time savings for anyone stacking credentials.

CC Vs. Security+ and Other Entry-Level Alternatives

The CC does not exist in a vacuum. Most people weighing it are also looking at CompTIA Security+, and a smaller group is comparing it against vendor-neutral fundamentals like the CompTIA ITF+ or Google Cybersecurity Certificate. Here is how the CC stacks up against the credential it competes with most directly.

CC vs. Security+: The Head-to-Head

Security+ is the older, more established entry-level credential and shows up more often in job postings, especially in government-adjacent roles. It also carries DoD 8140 approval across several workforce categories, which the CC has been slower to accumulate. That alone pushes many defense contractors and federal hiring managers toward Security+ as their preferred baseline.

• Exam fee: Security+ SY0-701 runs $439 in 2026.¹ ISC2 CC has historically offered free exam vouchers under its One Million Certified in Cybersecurity pledge, though you should verify current availability before assuming zero cost.
• Renewal: Security+ requires 50 CEUs over a three-year cycle plus a $150 CE fee, putting total three-year cost of ownership near $589.² The CC requires 45 CPEs over three years plus the ISC2 Annual Maintenance Fee.
• Depth: Security+ goes deeper into threats, cryptography, and architecture. The CC is broader but shallower, aimed at learners who have not yet worked in IT.
• Employer recognition: Security+ appears in significantly more job listings today, particularly for security analyst and security engineer roles.

Other Entry-Level Options

If you are not sold on either, the Google Cybersecurity Certificate on Coursera is a lower-stakes way to test your interest before committing to a proctored exam. GIAC's GFACT and Cisco's CCST Cybersecurity are also emerging as fundamentals-level options, though employer recognition varies. For pure IT literacy before touching security, ITF+ or Network+ are more appropriate starting points than the CC.

Frequently Asked Questions

Below are answers to the most common questions prospective candidates ask before registering for the ISC2 Certified in Cybersecurity exam. Each answer draws on the official ISC2 credential page and current candidate handbook.