Last updated September 2026
The short answer most people are searching for: no, the ISC2 CC exam isn’t free anymore for new candidates. ISC2 closed new enrollments in its One Million Certified in Cybersecurity program on May 20, 2026, so new candidates pay the standard $199 exam fee. A new exam outline also took effect September 1, 2026, the first major content update since CC launched in August 2022. Study the September 2026 outline.
Certified in Cybersecurity (CC) is the entry-level cert from the organization behind the CISSP. It covers security principles, governance, identity and access management, networking and cloud security, and security operations and incident response, all at a concepts level. No experience is required (see our list of certifications you can earn with no experience), the exam takes two hours, and it’s still the cheapest way to put an ISC2 credential on your résumé.
What happened to the free exam
No, not for new candidates. ISC2’s One Million Certified in Cybersecurity program gave more than a million people a free CC online course and a free exam. ISC2 says the program met its goal and closed new enrollments effective May 20, 2026 (ISC2).
- Already have a free exam code? If it hasn’t expired, you can still schedule and sit the exam, but every unexpired code must be used by December 31, 2026. Expired codes can’t be reactivated.
- Enrolled in the free course before May 20, 2026? You can keep using it until your course access expires. You don’t have to finish the course to take the exam.
- Starting now? The exam costs $199, and you pay a $50 annual maintenance fee after you pass.
ISC2 says it will keep working with public and private partners to reduce barriers to education and exams, so check with local workforce programs, schools and employers before you pay full price.
Is CC the right first cert for you?
CC makes sense if you’re:
- Switching careers and want a first security credential without years of IT behind you
- A student or recent graduate who needs something concrete on a résumé before the first security job
- In IT already (help desk, sysadmin, developer) and want to show a security foundation
- A manager or non-technical colleague of a security team who wants the vocabulary
ISC2 says no experience is needed and positions CC for IT professionals, career changers, and college students or recent graduates (ISC2). ISC2’s CC page also lists it under the U.S. DoD Manual 8140.03.
The main caveat: if you’re aiming at a hands-on technical job, CC alone won’t carry you. Security+ is broader and far more common in job posts, and Network+ teaches networking at a depth CC doesn’t attempt. Many people use CC as a confidence builder, then go straight on to Security+.
CC exam facts (September 2026 outline)
| Item | Details |
|---|---|
| Current exam outline | Effective September 1, 2026 |
| Format | Computerized Adaptive Testing (CAT) |
| Number of items | 100 to 125 |
| Time limit | 2 hours |
| Item types | Multiple choice and advanced item types |
| Passing score | 700 out of 1,000 |
| Languages | English, Chinese, Japanese, German and Spanish (Chinese only in set appointment windows) |
| Where you test | Pearson VUE test centers |
| Experience required | None |
| Exam price (Americas) | $199 |
| Annual maintenance fee | $50 a year |
| Renewal | Three-year cycle: 45 CPE credits (all Group A) plus the annual fee |
Sources: ISC2’s CC exam outline, exam pricing, annual maintenance fee FAQ and member policies. ISC2 prices vary by region and currency, so confirm at checkout.
The five domains after the 2026 rewrite
| Domain | Weight | What it covers |
|---|---|---|
| 1. Security Principles | 24% | The CIA triad, authentication, authorization and accounting, non-repudiation, privacy, risk management concepts, governance (laws, frameworks, policies), technical, administrative and physical controls, and the ISC2 Code of Ethics |
| 2. Security Governance | 17.3% | Governance, risk and compliance planning, business continuity and disaster recovery, security awareness (social engineering, phishing, password protection), and measuring effectiveness with metrics, key risk indicators and dashboards |
| 3. Identity and Access Management (IAM) Concepts | 20% | The identity life cycle (defining roles, provisioning, reviews, deprovisioning), least privilege, separation of duties and access control models |
| 4. Networking and Cloud Security Concepts | 21.3% | OSI and TCP/IP models, IPv4 and IPv6, VPNs, firewalls, wireless, embedded systems and IoT, segmentation, defense in depth, zero trust, cloud characteristics, service and deployment models, and the shared responsibility model |
| 5. Security Operations and Incident Response | 17.3% | Data handling and encryption (including quantum-resistant cryptography), logging and monitoring, event triage, threat actors and threat intelligence, incident response plans and exercises, asset and change management, and security testing |
ISC2 says the domains were renamed, reorganized and expanded to put more weight on governance, identity management, cloud security, threat intelligence and incident response (ISC2). It also added foundational AI concepts across all five domains, such as protecting training data from model poisoning and managing AI service accounts like any other identity (ISC2 exam outline). If your study guide still lists “Access Controls Concepts” or “Network Security” as domain names, it was written for the old outline.
Four weeks is enough if you already work in IT
CC is a foundations exam. Four weeks at five to seven hours a week is realistic for someone in IT. If everything here is new, double it.
- Week 1: principles and governance. Read the September 2026 outline end to end. Learn the CIA triad, risk terms (threat, vulnerability, likelihood, impact), control types, and the ISC2 Code of Ethics. Then cover domain 2: GRC basics, BC vs DR, and security awareness.
- Week 2: identity and networking. Identity life cycle, least privilege, separation of duties, access control models (DAC, MAC, RBAC). Then the OSI and TCP/IP models, common ports, firewalls, VPNs and segmentation.
- Week 3: cloud and operations. Cloud service and deployment models, the shared responsibility model and zero trust. Then logging and monitoring, incident response steps, encryption basics, data handling and security testing types.
- Week 4: practice and review. Take timed practice sets, review every miss against the outline, and reread ISC2’s AI guidance for each domain. CC questions reward picking the “best” answer for the situation, so read every option.
Where CC candidates slip
- Studying the old outline. Books and courses written before September 2026 use the old domain names. The September 2026 outline reweights governance, identity and cloud and adds AI concepts everywhere.
- Answering like a technician. ISC2 questions often ask for the “best” or “first” action. The answer is usually about policy, risk or process, not a clever technical fix.
- Skimming the ethics. The ISC2 Code of Ethics sits in domain 1. It’s easy points if you read it and annoying losses if you don’t.
- Underestimating adaptive testing. CAT adjusts to your answers, so there’s no coasting on your strong domains. Weakness anywhere shows.
What CC costs now
- Exam: $199 in the Americas and most regions (EUR 191.04 in EMEA and GBP 161.19 in the UK, per ISC2’s pricing page). Rescheduling costs $50 and canceling costs $100.
- Two-attempt option: ISC2 sells an exam with Peace of Mind Protection, which includes two attempts that must both be taken within 180 days of purchase, with a waiting period between them (ISC2).
- Annual maintenance fee (AMF): $50 a year for members who hold only CC. If you later earn another ISC2 certification such as CISSP or CCSP, you move to the $135 AMF (ISC2).
- Training: Optional. ISC2 sells self-paced and instructor-led courses, and many candidates pass with a book, a video course and practice questions.
So the first-year cost for a new candidate who studies on their own is $199 for the exam plus $50 for the first AMF: $249.
How employers see CC
As a signal that you know the fundamentals and can learn on the job. Not as a substitute for experience, and ISC2 doesn’t claim otherwise. In ISC2’s own survey data from the One Million program, 65% of employed CC holders work in cybersecurity roles and another 22% in IT roles (ISC2). That’s ISC2 reporting on its own certification, not an independent study.
For context on where it can lead, the U.S. Bureau of Labor Statistics reports a median pay of $129,180 for information security analysts in May 2025 and projects 21% employment growth from 2025 to 2035 (BLS). Most analysts get there with experience plus certifications, not CC alone.
CC also gets you into ISC2 as a certified member, which helps if you plan to go for the CISSP or CCSP later: you’ll already know how ISC2 writes questions and how its CPE system works.
From Donald: In my view, Security+ is the baseline hiring managers are looking for, and it is the minimum requirement for many federal jobs. CC is lesser known and not as respected.
CC compared with Security+, Network+ and CISSP
- CC vs Security+: Security+ is broader, more technical and more widely named in job posts and DoD 8140 requirements. CC is cheaper ($199 vs $439 for Security+ after CompTIA’s June 2026 increase) and shorter. Many people take CC first as a confidence builder, then Security+.
- CC vs Network+: Network+ goes much deeper on networking. CC covers networking at a concepts level only. If networking is your weak spot, Network+ will help more in interviews.
- CC vs CISSP: Not a real comparison. CISSP requires five years of experience and targets senior practitioners and managers. CC is where you start; CISSP is where many people end up.
- Next steps: Security+ → CySA+ for SOC work, PenTest+ or OSCP for offensive work, or CCSP for cloud once you have the experience. Want more IT fundamentals first? CompTIA A+ or the Google Cybersecurity Certificate pairs well with CC.
Picked your direction? The certification roadmap shows what comes after CC for SOC, offensive, cloud and governance paths.
If you’re switching careers, read How to Transition to a Cybersecurity Career at Any Age alongside this guide. Treat CC as your map of the field, not the destination. Learn the vocabulary well, because every later cert assumes it.
Learn the basics once. Keep up with the threats every day. The CyberExperts Daily Brief gives you five minutes of what changed in security, every weekday morning. Get tomorrow’s brief.
ISC2 CC: common questions
Is the ISC2 CC exam still free in 2026?
Not for new candidates. ISC2 closed new enrollments in One Million Certified in Cybersecurity on May 20, 2026. If you already have an unexpired free exam code, you must schedule and take the exam by December 31, 2026. Otherwise the exam costs $199, plus a $50 annual maintenance fee after you pass.
What does the CC exam look like?
Computerized Adaptive Testing with 100 to 125 items and a two-hour limit. You need 700 out of 1,000 to pass.
What changed in the September 2026 outline?
The exam still has five domains, but ISC2 renamed and reweighted them: Security Principles (24%), Security Governance (17.3%), Identity and Access Management Concepts (20%), Networking and Cloud Security Concepts (21.3%), and Security Operations and Incident Response (17.3%). It also added foundational AI security concepts across all five domains.
Do I need experience for ISC2 CC?
No. After you pass, you complete an application, agree to the ISC2 Code of Ethics and pay the $50 annual maintenance fee.
Can I still use my free One Million code?
Yes, if it hasn’t expired, but you must sit the exam by December 31, 2026. Expired codes can’t be reactivated.
How do I maintain CC?
Earn 45 Group A CPE credits during each three-year cycle (ISC2 suggests 15 a year) and pay the $50 annual maintenance fee.
Should I take CC or Security+?
CC is cheaper and easier and works well as a first step. Security+ is broader, more technical and more often required in job postings, so most people who start with CC go on to Security+.
Sources
- ISC2, Certified in Cybersecurity (CC) certification: isc2.org
- ISC2, CC exam outline (effective September 1, 2026): isc2.org
- ISC2 Insights, What’s new for entry-level cybersecurity: inside the updated CC exam (August 2026): isc2.org
- ISC2, One Million Certified in Cybersecurity has concluded: isc2.org
- ISC2, Exam pricing: isc2.org
- ISC2, Annual maintenance fees FAQ: isc2.org
- ISC2, Member policies (CPE requirements): isc2.org
- ISC2, Peace of Mind Protection: isc2.org
- BLS, Information security analysts: bls.gov
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
