Cybersecurity Certification Path and Map 2026: Entry to Expert, by Domain and Career Goal

Updated October 29, 2026: added a cybersecurity certifications map by domain and level. October 19, 2026: we rebuilt this guide around the question behind most searches for a cybersecurity certification path: which certifications to earn, and in what order. Experience rules, exam versions and DoD 8140 listings were checked against the certification bodies’ own pages on October 19, 2026. Exam fees change often, so this guide leaves them out. For current costs, see the cheapest cybersecurity certifications and our cybersecurity certification cost calculator. Not sure where you fit? Take the six-question which cybersecurity certification quiz. Already have an exam in mind? Our 10-question cert readiness quiz shows how ready you are.

Short answer: start with networking and a security baseline: CompTIA Network+, then CompTIA Security+, or ISC2 Certified in Cybersecurity (CC) if you have no IT background yet. Next, earn one intermediate certification in the specialty you want: CySA+ for SOC work, PenTest+ or CEH for penetration testing, a cloud provider’s security certification for cloud, CISA for audit, or Cisco CCNA for networking. Save the advanced credentials (CISSP, CISM, CCSP, SecurityX and OSCP+) for when you meet their experience rules.

There is no single correct order for everyone. A SOC analyst, a penetration tester, a cloud security engineer and a future CISO usually start in the same place and then split. This guide lays out that shared start, five specialty branches, and the experience each certification body asks for. Weighing two certifications against each other? See CISSP vs CISM, CISSP vs CCSP and CEH vs PenTest+ vs OSCP. For a ranked list instead of a path, see Best Cybersecurity Certifications in 2026.

The cybersecurity certification path at a glance

Most certifications fall into three levels, with expert concentrations on top. The experience column uses each certification body’s own wording, and “recommended” is not the same as “required” (see the next section).

Cybersecurity certifications map by domain and level

This map puts the certifications in this guide on one grid. Rows are the domain, or type of security work. Columns are the level, set by the experience each issuer requires or recommends. Read across a row to see how one specialty progresses, or down a column to see your options at your current stage.

How we placed each certification: entry certs need little or no experience (CompTIA recommends two years for Security+). Intermediate certs recommend or require about one to four years. Most advanced certs ask for five years or more; Google recommends three or more years for its Professional Cloud Security Engineer, and OSCP+ and Cisco CCNP Cybersecurity have no formal experience rule, so we placed them by the senior roles they target. Expert credentials sit on top of an advanced one. CISSP and SecurityX appear in more than one row because they span several domains. The exact rule for each cert is in the sections and comparison table below.

Some domains have their own deeper guides: incident response certifications, ethical hacking certifications for beginners, digital forensics certifications, OT security certifications and AI security certifications.

Required vs. recommended experience

Before you plan a path, check which kind of experience rule a certification has. It changes when you can sit the exam and when you can call yourself certified.

• CompTIA experience is only recommended. Security+ lists “CompTIA Network+ and two years of experience working in a security/ systems administrator job role” as recommended experience (CompTIA). You can book the exam without it.
• ISC2 and ISACA require experience to certify, but not to test. CISSP needs five years of cumulative, full-time experience in two or more of its eight domains (ISC2). CISM needs five or more years across at least three of the four CISM domains, and you must apply within five years of passing (ISACA). Pass an ISC2 exam early and you can hold the Associate of ISC2 designation while you earn the experience (ISC2).
• EC-Council checks eligibility before the CEH exam. You either attend official EC-Council training or show at least two years of information security work experience and pay an application fee (EC-Council).
• Cisco and OffSec have no formal prerequisites. Cisco lists “Prerequisites: None” for the 200-301 CCNA exam (Cisco). OffSec says PEN-200 has no formal prerequisites but strongly recommends TCP/IP networking knowledge, Windows and Linux administration experience, and basic Bash or Python scripting (OffSec).

Level 1: Entry certifications

The goal at this level is a first job in IT support, network administration, a SOC or a junior security role. You rarely need more than two or three. After that, depth in one branch helps more than a fourth entry-level badge.

CompTIA Network+

Almost every security job sits on top of networking. The current exam is N10-009, launched June 20, 2024, and CompTIA recommends the A+ certification plus 9 to 12 months of hands-on work as a junior network administrator or network support technician (CompTIA). If you already work with networks every day, you can skip it. If you have never worked in IT, CompTIA A+ comes first.

CompTIA Security+

Security+ is the security baseline that many job posts and DoD positions name. The current exam is SY0-701; its English version retires June 11, 2027 (CompTIA). CompTIA expects Security+ V8 (SY0-801) to launch on or around November 17, 2026 (CompTIA). If you are starting your study now, check which version you will sit before you buy a book. Our Security+ exam guide covers both.

ISC2 Certified in Cybersecurity (CC)

ISC2 says CC requires no work experience (ISC2). A new CC exam outline took effect on September 1, 2026 (ISC2). CC is a reasonable first step if you are coming from outside IT, but many job posts ask for Security+ instead, so treat CC as a stepping stone rather than a replacement. More options are in our guide to certifications you can earn with no experience, and the Google Cybersecurity Certificate is another structured starting point.

Cisco CCNA and CCST Cybersecurity

If you lean toward network engineering, the CCNA (exam 200-301) goes deeper into routing, switching and network security than Network+. Cisco lists no prerequisites, and the certification is valid for three years (Cisco). Cisco’s cybersecurity track starts with the CCST Cybersecurity, which Cisco calls a place to start “if you’re new to the security field” (Cisco).

Level 2: Pick a specialty branch

This is where the paths split. Read job posts for the role you want, in the city or sector you want, and note which certifications keep coming up. Those are your branch.

Security operations and defense (SOC, blue team)

Goal: detect, triage and respond to incidents, then grow into senior analyst, threat hunter or detection engineer.

1. Security+ for the baseline.
2. CompTIA CySA+, the analyst certification. The current CS0-004 exam launched June 23, 2026, and CompTIA recommends about four years in a SOC analyst or vulnerability analyst role (CompTIA). The older CySA+ V3 English exam retires December 22, 2026 (CompTIA). Not sure which to take first? Read how Security+ and CySA+ compare.
3. Alternatives and add-ons. Cisco’s CCNA Cybersecurity (exam 200-201 CCNACBR) covers security monitoring, host-based analysis and network intrusion analysis, with no formal prerequisites. In Microsoft Sentinel and Defender shops, Microsoft SC-200 fits the daily work. GIAC GSEC is a vendor-neutral alternative to Security+ that DoD lists at Intermediate for 22 work roles.
4. Later: CompTIA SecurityX if you want to stay hands-on as a senior engineer or architect, or CISSP if you are moving toward running a program.

Offensive security and penetration testing (red team)

Goal: find and exploit weaknesses with permission, write reports clients act on, and grow into senior tester or red teamer.

1. Network+ and Security+. CompTIA names both, or equivalent knowledge, in the recommended experience for PenTest+.
2. CompTIA PenTest+ or EC-Council CEH. PenTest+ (PT0-003, launched December 17, 2024) recommends 3 to 4 years in a penetration tester role (CompTIA). The CEH exam is 125 questions in four hours, and EC-Council requires official training or two years of information security experience first (EC-Council). Pick the one your target employers or contracts name.
3. OffSec OSCP+, the hands-on benchmark. Passing the exam earns both OSCP and OSCP+. OSCP has no expiration date, while OSCP+ expires three years from issuance unless you keep it current through one of OffSec’s continuing education paths (OffSec).

Our CEH vs PenTest+ vs OSCP comparison goes through exam format, renewal and DoD status side by side.

Cloud security

Goal: secure workloads in AWS, Google Cloud or Azure as a cloud security engineer or architect.

1. Security+ for the general security baseline the cloud exams assume.
2. A security certification for the cloud you use. AWS says AWS Certified Security – Specialty is intended for people with five years of IT security experience and two or more years of hands-on experience securing AWS workloads (AWS). Google recommends 3+ years of industry experience, including more than a year designing and managing solutions on Google Cloud, for the Professional Cloud Security Engineer. For Azure, Microsoft retired the Azure Security Engineer Associate certification on August 31, 2026 (Microsoft Learn). Its newer Cloud and AI Security Engineer Associate certification is earned with exam SC-500.
3. ISC2 CCSP, the vendor-neutral cloud credential. It requires five years of cumulative, full-time IT experience, three of them in cybersecurity and one in a CCSP domain. An active CISSP covers the whole requirement, and CSA’s CCSK certificate can stand in for one year (ISC2). See CISSP vs CCSP if you are choosing between them.

Governance, risk, compliance and audit (GRC)

Goal: run risk assessments, audits, authorizations and policy, then grow into security manager, director or CISO.

1. Security+, or equivalent experience. GRC leaders still need the technical vocabulary.
2. ISC2 CGRC or ISACA CISA. CGRC (formerly CAP) lists two years of required work experience (ISC2). CISA, the audit credential, requires five or more years of professional information systems auditing, control or security work experience (ISACA).
3. ISACA CISM or ISC2 CISSP. CISM centers on governance, risk, program management and incident management; CISSP is broader and more technical. Both need five years of experience. Our CISSP vs CISM comparison lays out who each one suits.

Network security

Goal: build and defend networks as a network security engineer, then move into architecture.

1. Network+, or skip straight to CCNA if you already work on networks.
2. Cisco CCNA, which Cisco aims at entry-to-mid-level IT professionals who want to specialize in networking, security or automation (Cisco).
3. Cisco’s cybersecurity track or Security+. Cisco’s three cybersecurity certifications run from CCST Cybersecurity to CCNA Cybersecurity to CCNP Cybersecurity (Cisco). If your target employers do not run Cisco gear, Security+ covers the vendor-neutral baseline.
4. Later: SecurityX or CISSP once you are designing security across the network rather than running it.

Level 3: Advanced and expert certifications

Most of these have experience rules you cannot shortcut, so plan them years ahead.

• ISC2 CISSP: five years of cumulative, full-time experience in two or more of the eight domains. A related bachelor’s or master’s degree, or a credential on ISC2’s approved list, can cover one year, and part-time work and internships can count (ISC2). If you pass without the experience, you can stay an Associate of ISC2 for up to six years (ISC2). ISC2 says the exam moves to a new outline on April 15, 2027 (ISC2). Read what to expect on the CISSP adaptive exam before you book, and if a first attempt goes badly, here is how to work out why and pass on the retake.
• ISACA CISM: five or more years of experience across at least three of the four CISM domains, with the application due within five years of passing (ISACA).
• ISC2 CCSP: five years of IT experience, three in cybersecurity and one in a CCSP domain, or an active CISSP (ISC2).
• CompTIA SecurityX (exam CAS-005, formerly CASP+): CompTIA recommends at least 10 years of general hands-on IT experience, including 5 years of hands-on security (CompTIA). It suits people who want to stay technical. Our SecurityX vs CISSP comparison covers which to take first.
• OffSec OSCP+: the hands-on penetration testing credential. OffSec designed its PEN-200 course to prepare you for the OSCP+ exam, and the course has no formal prerequisites (OffSec).
• CISSP concentrations: ISSEP (engineering), ISSAP (architecture) and ISSMP (management) sit on top of CISSP. If your work is moving toward securing or governing AI systems, AI security certifications are a newer add-on that builds on this level rather than replacing it. For ISSEP, ISC2 asks for a CISSP plus two years, or seven years cumulative (ISC2).

From the author: I earned ITIL, PMP, CASP (now CompTIA SecurityX) and CISSP, in that order. I did them in order from easier to harder, and I would do it again this way, because one prepares you for the next. ITIL preps you for CISSP, and CASP preps you for CISSP.

Cybersecurity certification path comparison table

Experience rules come from each certification body. The DoD 8140 column shows how Qualification Matrix V2.1 lists the certification (DoD 8140 Document Library).

“Not listed” means the certification does not appear in Matrix V2.1. To budget a whole path, plug the certifications you are considering into our cybersecurity certification cost calculator, which totals exam and renewal fees over the years you choose.

How DoD 8140 fits if you want a government job

For Defense Department jobs, the order of your certifications matters less than whether they match the position. DoD Manual 8140.03 took effect on February 15, 2023 and cancelled the old DoD 8570.01-M (DoDM 8140.03). Positions are now coded to a DoD Cyber Workforce Framework (DCWF) work role and a proficiency level: Basic, Intermediate or Advanced.

A certification is one way to meet the foundational part of qualification. Others include education, training and, in some cases, documented experience. You also complete residential qualification on the job and log at least 20 hours of continuous professional development a year. How the common path certifications show up in Qualification Matrix V2.1, which is still the current matrix in the DoD 8140 Document Library as of October 19, 2026:

• ISC2 CC is a Basic option for five roles, including 511 Cyber Defense Analyst and 531 Cyber Defense Incident Responder.
• Security+ is an Intermediate option for 19 roles, from 411 Technical Support Specialist to 612 Security Control Assessor.
• CySA+ is an Advanced option for 511 Cyber Defense Analyst and 531 Cyber Defense Incident Responder.
• CISSP and CISM are Advanced options for every role where the matrix lists them, mostly management, assessment and planning roles such as 722 Information Systems Security Manager.
• OSCP does not appear in V2.1, and the CCNA is listed only as an Advanced option for 441 Network Operations Specialist.

Contractors should read the contract or task order. A May 27, 2026 memo from the Department of War CIO tells DoD components to make sure contractors meet DCWF work role requirements and to update contracts (DoW CIO memo). Our DoD 8140 certifications guide lists approved certifications by work role, and IAM vs. IAT certifications explains how the old IAT and IAM levels translate.

How the NICE Framework maps to these branches

Outside DoD, the common U.S. reference for describing cyber work is the NICE Workforce Framework for Cybersecurity, published by NIST as SP 800-181 Rev. 1 (NIST). NICCS describes it as a common lexicon for cybersecurity work that applies across the public, private and academic sectors. CISA’s NICCS site uses NICE Framework Components version 2.2.0, which groups work roles into five categories; the Cyberspace Intelligence and Cyberspace Effects categories now sit in the DCWF instead (NICCS). NICCS also notes that work roles “are not synonymous to job titles or occupations,” so treat them as a way to read job descriptions.

Common mistakes on the certification path

• Starting with CISSP. You can pass the exam early, but you will be an Associate of ISC2, not a CISSP, until you have five years of experience. Hiring managers know the difference.
• Collecting entry-level certifications. Security+, CC and a stack of fundamentals certificates tell employers the same thing. After the baseline, go deeper in one branch.
• Ignoring renewals. CompTIA certifications renew on a three-year cycle through continuing education (CompTIA), the CCNA is valid for three years, ISC2 charges an annual maintenance fee, and OSCP+ expires after three years. The cheapest certifications guide lists the renewal fees.
• Studying the wrong version. Security+ V8 is expected around November 17, 2026, the CySA+ V3 English exam retires December 22, 2026, and CISSP moves to a new outline on April 15, 2027. Check the vendor page before you buy a book.

Where to start this week

If you are new to IT, book study time for Network+ or Security+ and set up a small home lab. If you already work in a SOC, look at CySA+. If you want to break things for a living, take PenTest+ or CEH, then OSCP+. If you already have five years in, choose CISSP or CISM depending on whether you want to lead a program or govern one. Keep a running list of what you built and learned along the way. That list wins interviews more often than the certification does.

Practice before you book an exam. Free certification practice for 12 cybersecurity exams. No card needed. CyberExperts Lab tracks on this path: Network+, Security+, ISC2 CC, SSCP, CEH, CISA, CCSP, SecurityX (CASP+), CISSP, CISM, CISSP-ISSEP and PMP. Always free.

Your certification path takes years. Attackers change tactics every week. The CyberExperts Daily Brief keeps you current while you study, in five minutes each weekday morning. Get tomorrow’s brief.

Frequently asked questions

Sources

• CompTIA, Network+ (N10-009) exam details: comptia.org
• CompTIA, Security+ V7 (SY0-701) exam details and retirement: comptia.org
• CompTIA, Security+ V8 (SY0-801) launch: comptia.org
• CompTIA, CySA+ (V3 retirement dates): comptia.org
• CompTIA, CySA+ V4 (CS0-004) exam details: comptia.org
• CompTIA, PenTest+ (PT0-003) exam details: comptia.org
• CompTIA, SecurityX (CAS-005) exam details: comptia.org
• CompTIA, Earn continuing education units (three-year renewal cycle): comptia.org
• ISC2, Certified in Cybersecurity (CC): isc2.org
• ISC2, CC exam outline (effective Sep 1, 2026): isc2.org
• ISC2, CISSP (new exam outline effective Apr 15, 2027): isc2.org
• ISC2, CISSP experience requirements: isc2.org
• ISC2, CCSP experience requirements: isc2.org
• ISC2, SSCP: isc2.org
• ISC2, CGRC: isc2.org
• ISC2, CISSP-ISSEP: isc2.org
• ISC2, Associate of ISC2: isc2.org
• ISACA, Get CISM certified: isaca.org
• ISACA, Get CISA certified: isaca.org
• EC-Council, Certified Ethical Hacker exam and eligibility: cert.eccouncil.org
• OffSec, PEN-200 and OSCP+: offsec.com
• GIAC, GSEC: giac.org
• Cisco, CCNA: cisco.com
• Cisco, Cybersecurity certifications: cisco.com
• Cisco, CCNA Cybersecurity: cisco.com
• AWS, AWS Certified Security – Specialty: aws.amazon.com
• Google Cloud, Professional Cloud Security Engineer: cloud.google.com
• Microsoft Learn, Azure Security Engineer Associate (retired Aug 31, 2026): learn.microsoft.com
• Microsoft Learn, Cloud and AI Security Engineer Associate: learn.microsoft.com
• NIST, SP 800-181 Rev. 1, Workforce Framework for Cybersecurity (NICE Framework): csrc.nist.gov
• CISA NICCS, NICE Framework work role categories (Components v2.2.0): niccs.cisa.gov
• DoD Manual 8140.03, Cyberspace Workforce Qualification and Management Program: esd.whs.mil (PDF)
• DoD CIO, DoD 8140 Document Library (Qualification Matrix V2.1): cyberworkforce.mil
• DoW CIO memo, DoD 8140 requirements for contractors (May 27, 2026): cyberworkforce.mil (PDF)

Donald Korinchak, MBA, PMP, CISSP, SecurityX, ITILv3

Donald Korinchak is a Cybersecurity Professional in the Washington DC area. Donald holds an MBA from the University of Pittsburgh Katz School of Business. Donald is considered a thought leader in business, leadership, and cybersecurity issues.