Updated September 2026: Two things changed for ISC2’s entry-level certification this year. ISC2 closed new enrollments in its free One Million Certified in Cybersecurity program on May 20, 2026, so new candidates now pay the standard $199 exam fee. And a new CC exam outline took effect September 1, 2026, the first major content update since CC launched in August 2022. If you’re studying now, study the September 2026 outline.
ISC2 Certified in Cybersecurity (CC) is the entry-level certification from the organization behind the CISSP. It proves you understand the basics: security principles, governance, identity and access management, networking and cloud security, and security operations and incident response. There’s no experience requirement, the exam is two hours, and it’s the cheapest way to get an ISC2 credential on your résumé.
This guide covers who CC is for, what happened to the free exam, the exam facts, the new domains and weights, the real cost, a four-week study plan, what CC does for your career, and how it compares with Security+ and Network+. If you’re switching careers, read How to Transition to a Cybersecurity Career at Any Age alongside it.
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Who ISC2 CC is for
- Career changers who want a first security credential without years of IT experience
- Students and recent graduates who want something concrete on a résumé before their first security job
- IT staff (help desk, sysadmins, developers) who want to show a security foundation
- Managers and non-technical staff who work alongside security teams and want the vocabulary
ISC2 says you don’t need experience for CC, and it positions the certification for IT professionals, career changers, and college students or recent graduates (ISC2). CC is also listed under the U.S. DoD Manual 8140.03 on ISC2’s CC page.
Is the ISC2 CC exam still free?
No, not for new candidates. ISC2’s One Million Certified in Cybersecurity program gave more than a million people a free CC online course and a free exam. ISC2 says the program met its goal and closed new enrollments effective May 20, 2026 (ISC2).
- Already have a free exam code? If it hasn’t expired, you can still schedule and sit the exam, but every unexpired code must be used by December 31, 2026. Expired codes can’t be reactivated.
- Enrolled in the free course before May 20, 2026? You can keep using it until your course access expires. You don’t have to finish the course to take the exam.
- Starting now? The exam costs $199, and you pay a $50 annual maintenance fee after you pass.
ISC2 says it will keep working with public and private partners to reduce barriers to education and exams, so check with local workforce programs, schools and employers before you pay full price.
ISC2 CC exam facts (2026)
| Item | Details |
|---|---|
| Current exam outline | Effective September 1, 2026 |
| Format | Computerized Adaptive Testing (CAT) |
| Number of items | 100 to 125 |
| Time limit | 2 hours |
| Item types | Multiple choice and advanced item types |
| Passing score | 700 out of 1,000 |
| Languages | English, Chinese, Japanese, German and Spanish (Chinese only in set appointment windows) |
| Where you test | Pearson VUE test centers |
| Experience required | None |
| Exam price (Americas) | $199 |
| Annual maintenance fee | $50 a year |
| Renewal | Three-year cycle: 45 CPE credits (all Group A) plus the annual fee |
Sources: ISC2’s CC exam outline, exam pricing, annual maintenance fee FAQ and member policies. ISC2 prices vary by region and currency, so confirm at checkout.
The five CC domains and their weights (September 2026 outline)
| Domain | Weight | What it covers |
|---|---|---|
| 1. Security Principles | 24% | The CIA triad, authentication, authorization and accounting, non-repudiation, privacy, risk management concepts, governance (laws, frameworks, policies), technical, administrative and physical controls, and the ISC2 Code of Ethics |
| 2. Security Governance | 17.3% | Governance, risk and compliance planning, business continuity and disaster recovery, security awareness (social engineering, phishing, password protection), and measuring effectiveness with metrics, key risk indicators and dashboards |
| 3. Identity and Access Management (IAM) Concepts | 20% | The identity life cycle (defining roles, provisioning, reviews, deprovisioning), least privilege, separation of duties and access control models |
| 4. Networking and Cloud Security Concepts | 21.3% | OSI and TCP/IP models, IPv4 and IPv6, VPNs, firewalls, wireless, embedded systems and IoT, segmentation, defense in depth, zero trust, cloud characteristics, service and deployment models, and the shared responsibility model |
| 5. Security Operations and Incident Response | 17.3% | Data handling and encryption (including quantum-resistant cryptography), logging and monitoring, event triage, threat actors and threat intelligence, incident response plans and exercises, asset and change management, and security testing |
ISC2 says the domains were renamed, reorganized and expanded to put more weight on governance, identity management, cloud security, threat intelligence and incident response (ISC2). It also added foundational AI concepts across all five domains, such as protecting training data from model poisoning and managing AI service accounts like any other identity (ISC2 exam outline). If your study guide still lists “Access Controls Concepts” or “Network Security” as domain names, it was written for the old outline.
What ISC2 CC costs in 2026
- Exam: $199 in the Americas and most regions (EUR 191.04 in EMEA and GBP 161.19 in the UK, per ISC2’s pricing page). Rescheduling costs $50 and canceling costs $100.
- Two-attempt option: ISC2 sells an exam with Peace of Mind Protection, which includes two attempts that must both be taken within 180 days of purchase, with a waiting period between them (ISC2).
- Annual maintenance fee (AMF): $50 a year for members who hold only CC. If you later earn another ISC2 certification such as CISSP or CCSP, you move to the $135 AMF (ISC2).
- Training: Optional. ISC2 sells self-paced and instructor-led courses, and many candidates pass with a book, a video course and practice questions.
So the first-year cost for a new candidate who studies on their own is $199 for the exam plus $50 for the first AMF: $249.
A four-week ISC2 CC study plan
CC is a foundations exam. If you already work in IT, four weeks at five to seven hours a week is realistic. If everything is new, double it.
- Week 1: principles and governance. Read the September 2026 outline end to end. Learn the CIA triad, risk terms (threat, vulnerability, likelihood, impact), control types, and the ISC2 Code of Ethics. Then cover domain 2: GRC basics, BC vs DR, and security awareness.
- Week 2: identity and networking. Identity life cycle, least privilege, separation of duties, access control models (DAC, MAC, RBAC). Then the OSI and TCP/IP models, common ports, firewalls, VPNs and segmentation.
- Week 3: cloud and operations. Cloud service and deployment models, the shared responsibility model and zero trust. Then logging and monitoring, incident response steps, encryption basics, data handling and security testing types.
- Week 4: practice and review. Take timed practice sets, review every miss against the outline, and reread ISC2’s AI guidance for each domain. CC questions reward picking the “best” answer for the situation, so read every option.
Is ISC2 CC worth it? Jobs and career value
CC won’t get you a senior role on its own, and ISC2 doesn’t claim it will. It signals that you understand the fundamentals and can learn on the job. In ISC2’s own survey data from the One Million program, 65% of employed CC holders work in cybersecurity roles and another 22% work in IT roles (ISC2). That’s ISC2’s data about its own certification, not an independent study.
For context on where it can lead, the U.S. Bureau of Labor Statistics reports a median pay of $129,180 for information security analysts in May 2025 and projects 21% employment growth from 2025 to 2035 (BLS). Most analysts get there with experience plus certifications, not CC alone.
CC also gets you into ISC2 as a certified member, which helps if you plan to go for the CISSP or CCSP later: you’ll already know how ISC2 writes questions and how its CPE system works.
ISC2 CC vs Security+, Network+ and CISSP
- CC vs Security+: Security+ is broader, more technical and more widely named in job posts and DoD 8140 requirements. CC is cheaper ($199 vs $439 for Security+ after CompTIA’s June 2026 increase) and shorter. Many people take CC first as a confidence builder, then Security+.
- CC vs Network+: Network+ goes much deeper on networking. CC covers networking at a concepts level only. If networking is your weak spot, Network+ will help more in interviews.
- CC vs CISSP: Not a real comparison. CISSP requires five years of experience and targets senior practitioners and managers. CC is where you start; CISSP is where many people end up.
- Next steps: Security+ → CySA+ for SOC work, PenTest+ or OSCP for offensive work, or CCSP for cloud once you have the experience. Want more IT fundamentals first? CompTIA A+ or the Google Cybersecurity Certificate pairs well with CC.
Planning your next certification? See the full certification roadmap for the order to take them by career goal.
What I would tell a friend starting CC
Treat CC as your map of the field, not the destination. Learn the vocabulary well, because every later certification assumes it. Then pick a direction (defense, offense, cloud or governance) and build hands-on skills while you study for the next cert.
Learn the basics once. Keep up with the threats every day. The CyberExperts Daily Brief covers what changed in security and why it matters, in five minutes, weekday mornings. Get tomorrow’s brief.
Frequently asked questions
Is the ISC2 CC exam still free in 2026?
Not for new candidates. ISC2 closed new enrollments in One Million Certified in Cybersecurity on May 20, 2026. If you already have an unexpired free exam code, you must schedule and take the exam by December 31, 2026. Otherwise the exam costs $199 plus a $50 annual maintenance fee after you pass.
How many questions are on the ISC2 CC exam?
The CC exam uses Computerized Adaptive Testing with 100 to 125 items and a two-hour time limit.
What is the passing score for ISC2 CC?
700 out of 1,000 points.
What changed in the September 2026 CC exam outline?
The exam still has five domains, but ISC2 renamed and reweighted them: Security Principles (24%), Security Governance (17.3%), Identity and Access Management Concepts (20%), Networking and Cloud Security Concepts (21.3%), and Security Operations and Incident Response (17.3%). It also added foundational AI security concepts across all five domains.
Do I need experience for ISC2 CC?
No. CC has no experience requirement. After you pass, you complete an application, agree to the ISC2 Code of Ethics and pay the $50 annual maintenance fee.
How do I maintain ISC2 CC?
Earn 45 Group A CPE credits during each three-year cycle (ISC2 suggests 15 a year) and pay the $50 annual maintenance fee.
Is ISC2 CC better than Security+?
They serve different purposes. CC is cheaper and easier and works well as a first step. Security+ is broader, more technical and more often required in job postings, so most people who start with CC go on to Security+.
Sources
- ISC2, Certified in Cybersecurity (CC) certification: isc2.org
- ISC2, CC exam outline (effective September 1, 2026): isc2.org
- ISC2 Insights, What’s new for entry-level cybersecurity: inside the updated CC exam (August 2026): isc2.org
- ISC2, One Million Certified in Cybersecurity has concluded: isc2.org
- ISC2, Exam pricing: isc2.org
- ISC2, Annual maintenance fees FAQ: isc2.org
- ISC2, Member policies (CPE requirements): isc2.org
- ISC2, Peace of Mind Protection: isc2.org
- BLS, Information security analysts: bls.gov
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
