IT, Cloud & Cybersecurity • Certification
ISC2 Certified in Cybersecurity
A free-training, entry-level on-ramp into cybersecurity.
Researched and maintained by TestPrepPilot Editorial BoardCloud, IT & cybersecurity certifications desk · Figures last verified August 2026
The short version
What is the ISC2 Certified in Cybersecurity and is it worth it?
ISC2 CC is a 2-hour, 100–125-question CAT exam scored 700/1000, costing $199. There is no experience requirement and free training is provided. It is valid three years with 15 CPE credits per year and the $135 Annual Maintenance Fee.
- Free official training from ISC2
- No experience prerequisite
- Accessible, entry-level on-ramp
- Builds toward SSCP and CISSP
What is it?
What exactly is the ISC2 Certified in Cybersecurity?
A free-training, entry-level on-ramp into cybersecurity.
ISC2 Certified in Cybersecurity (CC) is an entry-level credential designed for career changers and students. It covers security principles, business continuity, access control, network security and security operations basics. ISC2 provides free training, and there is no experience prerequisite, making it one of the most accessible first certifications.
The path in brief
- Use the free ISC2 CC course
- Book the CAT exam
- Pass at 700/1000
- Earn 15 CPE/year
- Progress to SSCP or CCNA-level
Before you book
Who is eligible to sit the ISC2 Certified in Cybersecurity?
Who it is for: Students, career changers and IT staff entering security.
The test itself
What is the format of the ISC2 Certified in Cybersecurity?
The ISC2 Certified in Cybersecurity is administered by Pearson VUE test centre or online proctoring and runs 2 hours, contains 100-125 (CAT) questions and requires 700 / 1000 scaled to pass.
| Administered by | Pearson VUE test centre or online proctoring |
|---|---|
| Questions | 100-125 (CAT) |
| Time limit | 2 hours |
| Pass mark | 700 / 1000 scaled |
| Exam fee | $199 |
| Format | Multiple choice + advanced items (CAT) |
Content outline
What topics are on the ISC2 Certified in Cybersecurity?
The ISC2 Certified in Cybersecurity covers 5 content domains.
Weightings come from the official exam outline. Study time is best allocated in roughly these proportions rather than evenly across domains.
- Security Principles
CIA triad, governance
- Business Continuity
BCP and disaster recovery
- Access Controls
Identity and access
- Network Security
Network defence concepts
- Security Operations
Monitoring and response basics
Money & time
How much does the ISC2 Certified in Cybersecurity cost?
For the ISC2 Certified in Cybersecurity, the exam fee is $199; the all-in cost is typically $199; most candidates spend 4-8 weeks preparing.
Cost breakdown
| Exam fee | $199 |
|---|---|
| Training | $0 (free) |
| Typical total | $199 |
Free ISC2 training is included; the only cost is the exam fee.
Timeline
- Study 4-8 weeks
Typical prep: 4-8 weeks
The path
How do you register for the ISC2 Certified in Cybersecurity?
- 1
Confirm eligibility
Most ISC2 credentials require paid work experience; you may sit the exam first and earn the Associate of ISC2 title if short on experience.
- 2
Register and pay
Pay the exam fee and schedule through Pearson VUE.
- 3
Pass the CAT exam
Complete the adaptive exam at a Pearson VUE centre or via online remote proctoring.
- 4
Submit endorsement
Have your experience endorsed by an ISC2 member within nine months of passing.
The fine print
What are the retake and renewal rules for the ISC2 Certified in Cybersecurity?
- Proctoring & delivery
- Delivered by Pearson VUE at test centres or via online proctoring. CC, CISSP, CCSP and SSCP use Computerized Adaptive Testing (CAT); CGRC, CSSLP and the CISSP concentrations use linear fixed forms.
- Retake policy
- If you fail, you wait 30 days for the second attempt, 60 days for the third, and 90 days for subsequent attempts within a one-year eligibility window.
- Score reporting
- All ISC2 exams are scored on a 700/1000 scale. CAT exams end when statistical confidence is reached; linear exams use the full item count.
- Recertification
- Certifications are valid for three years. Holders must earn Continuing Professional Education (CPE) credits and pay the Annual Maintenance Fee ($135) to keep the credential active.
What it pays
How much does this credential pay?
$124,910 median for information security analysts (BLS, May 2024)
There is no Bureau of Labor Statistics occupation called "ISC2 CC" — the Certified in Cybersecurity credential certifies entry-level cybersecurity knowledge, and the wage question belongs to the role you perform with it. The closest official BLS occupation is Information Security Analysts, SOC 15-1212, which had a May 2024 median wage of $124,910, with the lowest 10 percent under $71,280 and the highest 10 percent above $173,780. The fit is deliberate: ISC2 CC holders typically enter security-support, SOC and junior analyst roles that sit inside this occupation, though the realistic benchmark for a brand-new holder is the lower part of the distribution, climbing with experience and further certification. BLS counted 182,300 information security analyst jobs in 2024 and projects a striking 30 percent growth from 2024 to 2034 — much faster than the average for all occupations — with about 17,500 openings a year. The limitation to state plainly: the BLS median covers the whole occupation at all levels, and the CC is explicitly an entry-level credential; read the number as the market for the occupation you are entering, not the value of the entry certification, and note that employers typically require more than an entry credential for the analyst-level roles at the median.
| Measure | Figure | Source / note |
|---|---|---|
| Median annual wage, information security analysts | $124,910 | BLS OOH, SOC 15-1212, May 2024 |
| Lowest 10 percent | Under $71,280 | BLS OOH, SOC 15-1212, May 2024 |
| Highest 10 percent | Above $173,780 | BLS OOH, SOC 15-1212, May 2024 |
| Projected openings per year | ~17,500 | BLS OOH, SOC 15-1212, 2024-2034 |
Job growth.BLS projects 30 percent growth for information security analysts from 2024 to 2034, about 17,500 openings per year.
Source: BLS Occupational Outlook Handbook - Information Security Analysts
Your odds
What are the pass rates?
ISC2 publishes no pass rate — it publishes the passing score: 700 of 1000, with a 100-question, 2-hour exam
ISC2 does not publish cohort pass rates for the Certified in Cybersecurity exam, and third-party surveys are not official data, so we do not treat them as authoritative. What ISC2 does publish is the format and the passing standard: the CC exam has 100 questions, a 2-hour time limit, and a passing score of 700 on the 100-1000 scale. The exam is delivered at Pearson VUE centres or through online proctoring. The exam content follows the published domain outline: security principles; business continuity, disaster recovery and incident response concepts; access control concepts; network security; and security operations. The absence of a published pass rate is not an absence of standards: the 700 line is a meaningful bar, and the exam rewards understanding of security fundamentals across the domains rather than memorised trivia. The practical reading: target well above 700 on practice — 80 percent-plus — and use ISC2's official training and practice materials, the closest thing to the real item style. The CC is ISC2's entry credential, designed as an on-ramp to the field and to the broader ISC2 portfolio that includes the CISSP.
Read this before quoting the number.ISC2 publishes the passing score and format but no pass rate; any percentage circulating online is a third-party estimate.
Source: ISC2 - Certified in Cybersecurity (CC) certification
Your schedule
How long should I study for it?
40-80 hours over 4-6 weeks of focused study
The CC exam is a 100-question, 2-hour exam with a 700/1000 passing score, built on five published domains: security principles; business continuity, disaster recovery and incident response concepts; access control concepts; network security; and security operations. The credential is ISC2's entry certification, and the exam rewards a working understanding of security fundamentals rather than vendor-specific depth. A defensible plan runs 40 to 80 hours over 4 to 6 weeks. Weeks 1-2 cover security principles and access control: the core concepts of confidentiality, integrity and availability, risk management basics, and how authentication and authorisation work. Weeks 3-4 cover network security and security operations: network components, common attacks and defences, and the operational practices of monitoring and response. Week 5 covers business continuity, disaster recovery and incident response concepts. Week 6 adds practice-question drilling and a full timed simulation at the real 2-hour format. The plan is compact because the scope is entry-level, but the exam rewards applied understanding, so hands-on exploration of security concepts and systematic drilling matter more than reading volume.
- Weeks 1-225
Principles and access control
- CIA triad and risk management basics
- Authentication, authorisation and accounting
- Identity and access concepts
- Weeks 3-425
Network security and operations
- Network components and common attacks
- Defences and monitoring practices
- Security operations scenarios
- Week 510
BC, DR and incident response
- Business continuity concepts
- Disaster recovery planning
- Incident response fundamentals
- Week 615
Drill and simulate
- Practice-question drilling in volume
- One full timed 2-hour simulation
- Review weak domains
Adjusting the pace
IT professional cross-training.Compress the principles phase; spend the extra time on network security and operations scenarios.
Complete beginner.Add 2 weeks of IT fundamentals; the CC assumes basic computer and network literacy.
How to study
How do I prepare most effectively?
The CC exam rewards understanding across five domains, so the dominant strategy is broad coverage with applied drilling: work every domain rather than going deep on favourites, because the exam draws from all five. Second, use ISC2's official training materials and the published domain outline as the scope map; ISC2's entry-level training course is designed specifically for this exam. Third, drill the scenario items — described security situations with the correct principle, control or response — because the exam applies concepts rather than testing recall alone. Fourth, hold yourself to 80 percent-plus on practice exams, because the 700 line on a 100-question paper leaves no margin. Fifth, take at least one full timed simulation; 100 questions in 2 hours is about 72 seconds per item, and the pacing matters. Finally, treat the CC as the on-ramp it is designed to be: the material maps toward the CISSP and other ISC2 credentials, so study for understanding and plan the next certification while the momentum is fresh.
Cover all five domains
The exam draws from every domain; broad coverage beats deep dives.
Use ISC2 official training
The domain outline and official course are the scope map.
Drill the scenario items
The exam applies concepts; practise described situations.
Hold to 80%+ on practice
The 700/1000 line on 100 questions leaves no margin.
Plan the ISC2 path
The CC maps toward the CISSP; study for understanding.
What to buy
Which study resources are worth paying for?
CC prep is inexpensive because ISC2 designed the entry credential with accessible resources. ISC2's official training course (roughly $300-$500, and historically offered free during promotional periods), the free exam outline and practice questions cover most of the scope; the exam fee itself is about $199. Third-party providers sell CC courses and question banks at $50-$250, and the free cybersecurity fundamentals resources — NIST publications, online security courses and practice-question sites — add useful depth. A realistic total budget is $250 to $800 including the exam fee. Prices below are list prices as of mid-2026 and change frequently; we rank nothing by commission.
| Resource | Price | Format | Best for |
|---|---|---|---|
| ISC2 exam outline + domain docs | Free | Official PDFs | The authoritative scope; read them first |
| ISC2 official training course | $300-$500 | Self-paced online course | The official entry-level learning path |
| Third-party CC courses | $50-$250 | Video courses and quizzes | Structured walkthrough of the domains |
| Question banks | $30-$150 | Online practice items | Volume drilling before the exam |
| Free security fundamentals resources | $0 | NIST docs, online courses | Supplementary depth for beginners |
List prices as of mid-2026, subject to change; the CC exam fee is about $199; no commission or affiliate ranking is implied.
Avoid these
What mistakes do candidates most often make?
The most common CC mistake is memorising security vocabulary without understanding the principles: candidates who can recite definitions but cannot apply the right control to a described situation fail the applied items. The fix is scenario drilling from the start. The second mistake is skipping domains — the exam draws from all five, and candidates with a networking background routinely under-prepare the BC/DR and operations groups. Third, some candidates over-invest in expensive third-party courses when the official training and free resources suffice for an entry exam; scope discipline matters more than spend. Fourth, candidates misjudge the pace — 100 questions in 2 hours is 72 seconds per item, and slow readers run out of minutes. Finally, treating the CC as the end of the path is the quiet mistake: the credential is ISC2's on-ramp, and the analyst-level market the BLS numbers describe is served by the CISSP and experience, so plan the next step.
✕Memorising vocabulary
✓Drill applied scenarios; the exam rewards the right control for the situation.
✕Skipping domains
✓Cover all five; networking-only candidates under-prepare BC/DR and operations.
✕Over-investing in courses
✓Official training plus free resources suffice for an entry exam.
✕Misjudging the pace
✓100 questions in 2 hours; run a timed simulation.
✕Treating CC as the finish
✓It is the on-ramp; plan the CISSP and the experience path.
What you'll face
What question types will I see?
The CC exam is a 100-question multiple-choice exam in 2 hours. The items test security fundamentals across the five domains — security principles, BC/DR and incident response concepts, access control, network security, and security operations — with a large share of scenario items presenting a described situation and asking for the correct principle, control or response. The exam rewards applied understanding of security concepts rather than vendor-specific recall. Samples below are editor-written illustrations of the published domain outline, not live exam items; they show the applied style of the real items.
Principles, controls and terminology across the five domains.
Described situations with the correct security response.
Try these
Q1A security analyst must protect data in transit between a browser and a web server. The most appropriate control is:
Answer:A
TLS encrypts data in transit between client and server, protecting it from interception. Firewall rules allowing all traffic, password policy and full-disk encryption address different risks — none protects the transit channel.
Q2An organisation's primary data centre is destroyed in a flood. Which plan defines how the organisation resumes critical operations?
Answer:A
The disaster recovery plan defines how an organisation recovers critical systems and resumes operations after a disaster. Password policy, acceptable use and network diagrams are operational documents, not recovery plans.
Q3Which authentication factor is an example of "something you have"?
Answer:A
A hardware token is "something you have" — a possession factor. Passwords and PINs are knowledge factors, and fingerprints are biometric (inherence) factors.
Samples are editor-written illustrations of the published domain outline, not live exam items.
The big day
What should I expect on exam day?
The CC exam is a 100-question, 2-hour computer-based exam at a Pearson VUE centre or through online proctoring. Bring a valid government-issued photo ID matching your registration name and your appointment confirmation; personal items go in the locker. Arrive 30 minutes early; late arrivals forfeit the appointment and the fee. Pace at about 72 seconds per item, flag uncertain items for review, and finish with time to spare. You receive your score on screen immediately, with the official result following; ISC2 reports your scaled score against the 700 line. If you fail, retake per ISC2 rules. On a pass, the certification requires an annual maintenance fee to stay current, and ISC2's entry credential has lighter maintenance than the professional credentials. The afterwards matters: the CC is an on-ramp — plan the next ISC2 credential (commonly the CISSP once experience accumulates) and begin building the security experience the analyst market rewards.
Bring
- Valid government-issued photo ID matching your registration name
- Appointment confirmation
Leave at home
- Phone, smartwatch and all electronics
- Notes and study materials
- Personal bags beyond what the centre allows
How the day runs
Rules in the room
- No personal electronics in the testing room
- 2 hours for 100 questions; the clock does not pause
- Retake rules apply after a fail
Afterwards.On a pass, keep the CC current with the annual maintenance fee. On a fail, retake after additional domain study. Use the credential as the on-ramp to the CISSP and the analyst market.
Reference
What are the key facts about the ISC2 Certified in Cybersecurity?
ISC2 Certified in Cybersecurity is a certification credential; awarded by ISC2; the exam fee is $199; typical preparation is 4-8 weeks; holders typically earn $60,000-$90,000.
| Credential | ISC2 Certified in Cybersecurity |
|---|---|
| Abbreviation | CC |
| Type | Certification |
| Profession | IT, Cloud & Cybersecurity |
| Specialty | Cybersecurity (Vendor-Neutral) |
| Awarded by | ISC2 |
| Difficulty | Easy |
| Typical prep time | 4-8 weeks |
| All-in cost | $199 |
| Typical salary range | $60,000-$90,000 |
| Delivery | Pearson VUE CAT exam |
| Retake | 30/60/90-day waiting periods |
| Validity | 3 years; 15 CPE/yr + $135 AMF |
| Scope | National / Multi-state |
| Also known as | ISC2 CC |
Real questions
Frequently asked questions about the ISC2 Certified in Cybersecurity
Is there a prerequisite for ISC2 CC?
No. CC is explicitly designed for beginners, and ISC2 provides free training to prepare.
How is the exam delivered?
As a Computerized Adaptive Test of 100–125 questions over two hours at a Pearson VUE centre or via online proctoring, scored 700/1000.
What does CC cover?
Security principles, business continuity, access controls, network security and security operations fundamentals.
How do I maintain CC?
Three years of validity with 15 CPE credits per year and the $135 Annual Maintenance Fee.
What score do I need to pass an ISC2 exam?
A scaled score of 700 out of 1000 on every ISC2 certification exam.
Can I take the exam before I have the required experience?
Yes. You receive the Associate of ISC2 title and have a set period (commonly two years) to submit verified experience.
In short
Is the ISC2 Certified in Cybersecurity worth it?
- ISC2 CC is a free-training entry-level cert
- 100-125 CAT questions, 2 hours, 700/1000, $199
- No experience prerequisite
- 3-year validity; 15 CPE/yr + AMF
Same awarding body
What other credentials does ISC2 award?
Worth comparing
How does the ISC2 Certified in Cybersecurity compare with similar credentials?
Trust
Where does this information come from?
Everything above is taken from the awarding body's own published material. Fees, question counts and domain weights are revised regularly — check the official page before you pay.
- ISC2 Awarding body
- Official ISC2 Certified in Cybersecurity exam page Exam page
- ISC2 certification programme Programme rules
Research confidence: high · Last reviewed 2026-08