Certification overview

ISC2 CC Study Resources and Certification Overview

Use the September 2026 ISC2 Certified in Cybersecurity outline to organize entry-level study across security principles, governance, identity, networking and cloud security, and security operations.

Study resources

ISC2 CC practice and study resources

Start with the current question bank or study guide, use quick reviews for focused distinctions, then open a domain guide when you need deeper coverage.

Practice tests

Build a randomized 10, 20, 30, or 50-question session from the current CC question bank and review detailed explanations.

Final review

Compress the September 2026 CC outline into the distinctions, sequences, security decisions, and scenario clues worth having fresh before another practice test or exam day.

References

Use the acronym reference for quick terminology lookup while working through the current CC study and practice resources.

Current reference

Current CC outline

This hub follows the current CC exam outline

ISC2's revised CC outline took effect September 1, 2026. Cert Happens practice and study resources on this hub use its five-domain structure and published weights.

At a glance

What ISC2 CC covers

Certified in Cybersecurity (CC) is an entry-level ISC2 certification for people building foundational cybersecurity knowledge. ISC2 does not require prior cybersecurity work experience or a formal degree, although basic information technology knowledge is recommended.

The current outline covers security principles, governance, identity and access management, networking and cloud security, and security operations and incident response.

Delivery

Computerized adaptive testing (CAT)

Exam time

2 hours

Items

100 to 125

Passing score

700 out of 1000

Item format

Multiple choice and advanced item types

2026 exam update

The current CC outline took effect September 1, 2026

ISC2 revised the names, scope, and weights of the five CC domains on September 1, 2026.

Cert Happens CC resources follow that current outline. The effective date remains here as version context for older books, notes, and course material.

Effective date

September 1, 2026

Domains

5

Numbered objectives

19

Candidate fit

Who ISC2 CC is built for

CC is designed for newcomers who want to demonstrate foundational knowledge for an entry- or junior-level cybersecurity role. It can fit students, career changers, IT professionals moving toward security, and learners who want a security-first starting point.

No work experience is required, but the exam still uses real security and technology concepts. Basic familiarity with computers, accounts, networks, applications, and common IT terminology gives the material useful context.

Signals that CC may fit your starting point
  • Cybersecurity is new to you, but basic IT concepts are becoming familiar.
  • You want an entry-level security certification without a work-experience prerequisite.
  • You want to build security vocabulary and reasoning before moving into broader or more advanced certifications.
  • You want a structured foundation spanning governance, identity, networking, cloud security, operations, and incident response.

Building on a foundation

How CC turns basic IT knowledge into security reasoning

ISC2 recommends basic IT knowledge but does not require professional experience. CC builds on ordinary technology concepts by asking what they mean for protection, access, resilience, and response.

Accounts and permissions

Basic IT context: Recognize users, accounts, groups, roles, and permissions in common systems.

ISC2 CC perspective: Connect identity provisioning, review, deprovisioning, least privilege, separation of duties, and access-control models to security outcomes.

Networks and cloud services

Basic IT context: Understand basic network connectivity, addresses, protocols, applications, wireless access, and hosted services.

ISC2 CC perspective: Connect network models, firewalls, segmentation, zero trust, wireless, cloud models, and shared responsibility to security design.

Operations

Basic IT context: Recognize logs, updates, configuration changes, backups, alerts, and routine system administration.

ISC2 CC perspective: Use logging, event triage, threat information, incident response, change management, and security testing as parts of an operating security program.

Governance and resilience

Basic IT context: Understand that organizations use policies, procedures, roles, reporting, and recovery plans to manage technology.

ISC2 CC perspective: Connect risk, governance, compliance, business continuity, disaster recovery, awareness, and effectiveness measures to organizational security.

Official scope

Five current CC domains

These are the average domain weights published by ISC2 for the outline effective September 1, 2026.

Domain 1 · 24%

Security Principles

Cybersecurity concepts, risk management, governance concepts, technical, administrative, and physical controls, and professional and ethical conduct.

Domain 2 · 17.3%

Security Governance

Governance, risk, and compliance planning, business continuity and disaster recovery, security awareness, and measures of cybersecurity effectiveness.

Domain 4 · 21.3%

Networking and Cloud Security Concepts

Network fundamentals, firewalls, wireless and embedded systems, segmentation, defense in depth, zero trust, cloud models, and shared security responsibilities.

Domain 5 · 17.3%

Security Operations and Incident Response

Data security, cryptography, monitoring and triage, threat information, incident response, asset protection, change management, and security testing.

Starting point

Experience and certification path

ISC2 lists no specific prerequisites for the CC exam. Basic information technology knowledge is recommended, but cybersecurity work experience and a formal educational degree are not required.

That makes CC a practical first security credential rather than a certification that assumes an established security career. Later certification choices can depend on the work you begin doing and the areas of security you decide to deepen.

Exam policies and certification requirements can change, so confirm current registration and membership details with ISC2 before scheduling.

Exam prerequisites

None specified

Cybersecurity work experience

Not required

Recommended background

Basic IT knowledge

Study approach

A practical preparation sequence

Step 1

Start with the current outline

Use the five domains and nineteen numbered objectives as the study checklist. Older CC material may still follow the previous outline.

Step 2

Fill basic IT vocabulary gaps early

Make sure accounts, permissions, IP addressing, ports, applications, wireless networks, cloud services, logs, updates, and configuration changes are not all new at once.

Step 3

Learn distinctions that drive decisions

Separate authentication from authorization and accounting, business continuity from disaster recovery, least privilege from separation of duties, and preventive controls from detective or corrective ones.

Step 4

Connect network and cloud concepts to security

Do not stop at definitions. Practice explaining why segmentation, firewalls, zero trust, shared responsibility, and secure wireless or embedded-system choices reduce specific risks.

Step 5

Practice explaining why alternatives are weaker

For each scenario, identify the requirement first, choose the control or action that best fits it, and review why plausible alternatives do not satisfy the same need.

Confirm current requirements with ISC2

The exam outline, delivery details, policies, and certification requirements can change. Check the official ISC2 sources before making registration decisions.

CertHappens is an independent study resource and is not affiliated with or endorsed by ISC2.