ISC2 CC September 2026 Final Review

This page is for the point when the five CC domains are already familiar. It compresses the September 2026 outline into the distinctions and decisions that are easy to blur together: confidentiality versus integrity, policy versus standard, continuity versus recovery, least privilege versus separation of duties, segmentation versus zero trust, classification versus sanitization, monitoring versus incident response, and the security responsibilities that remain in cloud and AI environments.

If a section below feels new rather than familiar, return to the ISC2 CC study guide or the matching domain guide. Final review is retrieval practice, not a substitute for learning the material.

Final-review rule: Identify the security objective, the decision level, and the evidence in the scenario. Then choose the answer that addresses that requirement most directly without granting more trust, access, or scope than necessary.

1. How to use this final review

Read through once without trying to memorize every sentence. Stop when you hesitate, explain the distinction in your own words, and mark only the weak spots that still need deeper review.

A useful final-review cycle is:

Say what the concept means before reading the reminder.
For two similar answers, state the requirement that separates them.
Follow identities through creation, access, review, change, and removal.
Follow data through classification, use, protection, retention, and disposal.
Follow incidents from preparation and triage through recovery and improvement.
Ask who owns each cloud or security responsibility instead of assuming the provider owns everything.
Finish with a fresh practice set so recall has to work without the page open.

CC is foundational, so the best answer is often the one that applies a security principle correctly rather than the answer with the most advanced product name.

2. Current exam snapshot

This review follows the ISC2 Certified in Cybersecurity exam outline effective September 1, 2026.

Exam detail	Current CC format
Delivery	Computerized Adaptive Testing (CAT)
Time	2 hours
Items	100 to 125
Item types	Multiple choice and advanced item types
Passing grade	700 out of 1000 points
Item review	Once a CAT answer is finalized, it cannot be reviewed or changed

Because you cannot return to a finalized CAT item, read the requirement before committing. Do not spend the entire exam trying to infer whether a question is "easy" or "hard." The adaptive system chooses later items partly from earlier responses, and difficulty is not reliably visible to the candidate.

The exam outline is the coverage contract. This page is a Cert Happens review aid built around that official scope.

3. The five-domain map

Domain	Weight	Objectives	Keep fresh
1. Security Principles	24%	1.1 through 1.5	CIA, AAA, risk, governance, controls, ethics, due care, due diligence
2. Security Governance	17.3%	2.1 through 2.4	GRC, continuity, recovery, awareness, culture, metrics, KRIs
3. Identity And Access Management Concepts	20%	3.1 through 3.2	Identity lifecycle, least privilege, separation of duties, access models
4. Networking and Cloud Security Concepts	21.3%	4.1 through 4.3	Network models, VPNs, firewalls, segmentation, zero trust, cloud models, shared responsibility
5. Security Operations and Incident Response	17.3%	5.1 through 5.5	Data protection, crypto, triage, CTI, IR, assets, changes, testing

The percentages help with study priority, but the domains are connected. Identity failures create operational alerts. Governance determines acceptable risk. Segmentation supports network security and incident containment. Data classification affects cloud handling, encryption, response, and disposal.

4. Security Principles

Domain 1 is the largest domain at 24%. Its concepts are reused everywhere else.

CIA answers what security property is at risk

Confidentiality: Prevent unauthorized disclosure.
Integrity: Protect accuracy, completeness, and authorized state.
Availability: Keep authorized access and services usable when needed.

A stolen confidential file is primarily a confidentiality problem. An attacker changing payment details is an integrity problem. A denial-of-service condition targets availability.

AAA answers identity and access questions

Authentication: Verify who or what is requesting access.
Authorization: Decide what that identity may do.
Accounting: Record activity for accountability, investigation, or review.

A user can authenticate successfully and still be denied by authorization. Multifactor authentication strengthens identity verification; it does not grant permission by itself.

Non-repudiation supports evidence that an action or message can be attributed so the responsible party cannot credibly deny it later. Privacy concerns appropriate collection, use, disclosure, retention, and protection of information about people.

Follow the risk lifecycle

A practical risk flow is:

Identify assets, objectives, obligations, and dependencies.
Identify threats, vulnerabilities, and harmful conditions.
Assess likelihood and impact using the organization's method.
Decide how the risk should be handled.
Apply appropriate controls.
Accept, avoid, transfer, or reduce the remaining exposure through the authorized process.
Monitor for changes.

Inherent risk exists before safeguards are considered. Residual risk remains after safeguards are applied.

The risk owner or other authorized decision maker accepts residual risk. A technician finding the risk does not automatically have authority to accept it for the organization.

Keep governance documents in order

Item	What it does	Question clue
Law or regulation	Creates an external legal or regulatory obligation.	What must the organization comply with?
Framework	Provides a structured way to organize or manage security work.	What structure guides the program?
Policy	States management direction and required outcomes.	What does management require?
Standard	Sets a mandatory, specific requirement.	What measurable rule must be met?
Procedure	Describes the approved steps for doing work.	How is the task performed?
Guideline	Provides recommended advice where judgment is allowed.	What approach is preferred?

Control category and control purpose are different labels

A technical control uses technology. An administrative control uses management direction or process. A physical control protects facilities, equipment, or people.

A control may also be described by what it does: preventive, detective, corrective, deterrent, recovery, or compensating. One safeguard can serve more than one purpose.

Due care and due diligence are ongoing responsibilities

Due care means taking reasonable and appropriate steps to protect people, assets, and interests from foreseeable harm.

Due diligence is the continuing work of investigating, verifying, monitoring, and documenting whether protections remain appropriate and effective.

Ethical questions should also keep the ISC2 Code of Ethics in view. An expedient action is not automatically acceptable because it solves the immediate technical problem.

5. Security Governance

Domain 2 asks how an organization directs security work, remains resilient, builds safer behavior, and measures whether the program is working.

GRC connects direction, uncertainty, and obligations

Governance sets direction, accountability, and oversight.

Risk management identifies and prioritizes uncertainty that could affect objectives.

Compliance addresses requirements the organization is obligated or committed to meet.

Governance, Risk, and Compliance (GRC) tools can help collect evidence, map controls, track findings, assign ownership, and report status. The tool supports the process; it does not replace accountable decisions.

Business continuity and disaster recovery solve different parts of disruption

Business Continuity (BC) keeps critical business functions operating at an acceptable level during and after disruption.

Disaster Recovery (DR) restores technology, data, and supporting services after disruption.

A Business Impact Analysis (BIA) helps identify critical functions, dependencies, impacts, and recovery priorities.

Recovery Time Objective (RTO): How quickly should the service or process be restored?
Recovery Point Objective (RPO): How much data loss, measured backward in time, can be tolerated?

Redundancy can reduce the impact of a component failure, but redundant components still need independent failure paths, monitoring, testing, and recovery planning.

Awareness is about behavior and culture

Security awareness should change what people notice and do. Leadership support, reporting paths, relevant training, and repeated reinforcement matter because phishing, social engineering, password misuse, and unsafe handling are behavioral risks.

Training completion proves that training was delivered. It does not prove that the underlying risk improved.

Measures should answer a question

A Key Performance Indicator (KPI) can show whether an activity or process is meeting an intended performance target.

A Key Risk Indicator (KRI) signals changing exposure that may require attention.

Dashboards summarize current information. Scorecards compare performance against defined expectations. Reports provide context, analysis, and supporting detail.

If management asks whether phishing exposure is increasing, a risk-oriented measure is stronger than simply reporting how many people clicked "complete" on training.

6. Identity and Access Management

Domain 3 has only two numbered objectives, but identity decisions appear across the rest of the exam.

Identity is a lifecycle

A secure identity process follows why access exists:

Define the role and required access.
Provision the identity and approved permissions.
Authenticate and authorize use.
Review access periodically.
Change access when the role or risk changes.
Deprovision when the need ends.

Leaving a departed user's account enabled is a lifecycle failure even if the original account creation was correct.

Least privilege and separation of duties solve different problems

Principle of Least Privilege (PoLP) limits an identity to the minimum access needed for its approved work.

Separation of Duties (SoD) divides incompatible responsibilities so one person cannot control a sensitive process end to end.

A user may have only finance permissions and still violate separation of duties if that same user can create a vendor and approve payment to the vendor.

Match the access model to the decision rule

Model	Decision basis	Strong clue
RBAC	Permissions follow roles.	Job function or organizational responsibility
ABAC	Policy evaluates attributes about subject, resource, action, and environment.	Department, device state, location, time, sensitivity
DAC	An owner can grant access under system rules.	Owner-controlled sharing
MAC	Central rules and labels determine access.	Security classification or centrally enforced label

Do not choose Role-Based Access Control (RBAC) only because a scenario mentions a person's role. If access depends on several changing attributes, Attribute-Based Access Control (ABAC) may fit better.

7. Networking and Cloud Security

Domain 4 is 21.3% of the current outline. Keep the networking foundation simple enough that the security decision stays visible.

Use the network models to locate the control

The Open Systems Interconnection (OSI) model and Transmission Control Protocol/Internet Protocol (TCP/IP) model help place symptoms and controls.

Physical and data-link concerns include media, radio, frames, Media Access Control (MAC) addresses, switches, and Virtual Local Area Networks (VLANs).
Network-layer concerns include IPv4, IPv6, routing, and packet delivery.
Transport concerns include TCP, UDP, and ports.
Application concerns include services such as DNS, HTTPS, email, and remote administration.

A firewall can filter by addresses, protocols, ports, application information, or state depending on its capabilities. A port number is a clue about an application, not proof that the expected application is actually using that traffic.

A Virtual Private Network (VPN) protects traffic across an untrusted or shared path. It does not automatically decide which internal resources the user should be authorized to access.

Wireless and embedded systems change the risk context

Wi-Fi and Bluetooth add radio exposure and authentication choices. Internet of Things (IoT) and Industrial Control System (ICS) environments may have long lifecycles, specialized protocols, limited update options, or strong availability and safety requirements.

Useful controls include strong authentication, protected management, segmentation, appropriate encryption, inventory, change control, and limiting unnecessary services or communication paths.

Segmentation, defense in depth, and zero trust are related but distinct

Segmentation divides networks or workloads to reduce unnecessary communication and limit the effect of compromise.
VLANs can create Layer 2 separation but still need routing or policy enforcement between segments.
Microsegmentation applies finer-grained separation, often around workloads or applications.
Defense in Depth uses multiple complementary safeguards so one control failure does not expose everything.
Zero Trust (ZT) avoids granting implicit trust based only on location or ownership and requires explicit policy-based access decisions.

"Inside the network" is a location, not proof that a user, device, service, or request should be trusted.

Know the cloud characteristics

The current outline expects these core cloud characteristics:

Broad network access
Rapid elasticity
Measured service
On-demand self-service
Resource pooling

Keep the service models straight:

Infrastructure as a Service (IaaS): The customer manages more of the operating system, applications, identities, configuration, and data.
Platform as a Service (PaaS): The provider manages more of the platform and runtime; the customer focuses more on applications, identities, configuration, and data.
Software as a Service (SaaS): The provider operates the hosted application; the customer still manages appropriate use, access, configuration, and data responsibilities.

Deployment models include private, community, public, and hybrid cloud.

The shared security model divides responsibility. Moving a workload to SaaS changes the boundary; it does not erase the customer's duties for accounts, data, configuration, acceptable use, and contractual obligations.

8. Security Operations and Incident Response

Domain 5 turns security principles into day-to-day decisions.

Match the data action to the requirement

Action	Purpose	Exam clue
Classification	Assign sensitivity or handling level.	How sensitive is this information?
Labeling	Mark data or assets so the classification can be applied.	How is the classification communicated?
Masking	Hide part of a value while keeping a usable representation.	Show only the last four digits.
Sanitization	Remove data appropriately before reuse or disposal.	Make old media safe to release.

Cryptography choices solve different jobs

Symmetric cryptography: Same secret key is used for encryption and decryption. Efficient for protecting large amounts of data; secure key distribution matters.
Asymmetric cryptography: Uses a related public/private key pair. Supports uses such as digital signatures, key establishment, and identity-related operations.
Hashing: Produces a one-way digest used for integrity checks and other security purposes. Hashing does not create reversible ciphertext.
Quantum-resistant cryptography: Uses cryptographic approaches designed to remain secure against relevant attacks from future cryptographically capable quantum computers.

A digital signature can support integrity, origin authentication, and non-repudiation. It does not make the signed content confidential by itself.

Monitoring is not triage, and triage is not incident response

Monitoring collects and observes security-relevant activity.

Triage decides which events matter, how urgent they are, and what evidence or action comes next.

Cyber Threat Intelligence (CTI) is analyzed threat information intended to support decisions. Threat frameworks such as MITRE ATT&CK help describe adversary behavior consistently.

Incident Response (IR) coordinates handling once an event is treated as an incident. A useful flow is preparation, identification and triage, containment, correction or eradication where appropriate, recovery, and lessons learned.

The right first action depends on the scenario. Immediately powering off a critical system may reduce one risk while destroying volatile evidence or causing a larger outage. Follow the Incident Response Plan (IRP), assigned authority, safety priorities, and evidence-handling requirements.

Tabletop exercises walk participants through a scenario to test decisions, roles, communications, and plans without creating the full operational impact of a live incident.

Configuration and change management answer different questions

Configuration management defines, documents, maintains, and verifies approved system state.

Change management controls movement from one approved state to another through request, impact review, approval, testing, implementation, rollback planning, documentation, and validation.

An emergency may justify an accelerated process. It does not justify an invisible change with no accountability or later review.

Asset protection continues to end of life

Know what the organization owns, who is responsible for it, what it supports, which data it handles, how it is configured, whether it remains supported, and how it will be retired.

End Of Life (EOL) software or devices create risk when patches, compatibility, or vendor support end. Compensating controls may reduce exposure temporarily, but lifecycle planning should address replacement.

Testing methods answer different questions

Activity	Main question
Vulnerability scanning	Which known weaknesses or unsafe conditions can we identify?
Static analysis	What weaknesses can be found by examining code or artifacts without running the application?
Dynamic analysis	What weaknesses appear while the application is running?
Threat modeling	Which assets, trust boundaries, threats, and attack paths should the design account for?
Red team	How would an adversary challenge the environment within scope?
Blue team	How well can defenders prevent, detect, and respond?
Purple team	How can offensive and defensive perspectives collaborate to improve controls?
Physical penetration testing	Can authorized testing expose physical or human weaknesses such as tailgating or impersonation?

Finding a weakness is different from proving exploitation, and proving exploitation is different from deciding the business priority. Context still matters.

9. AI security across the current outline

The September 2026 outline integrates foundational Artificial Intelligence (AI) security across all five domains. AI does not create a sixth CC domain. Apply the same security principles to AI systems, automated identities, data, infrastructure, and security tools.

Domain	AI security lens
1. Security Principles	Protect training data and AI assets with CIA, AAA, privacy, governance, controls, and ethical decision making. Model poisoning is an integrity concern.
2. Security Governance	Include automated phishing and social engineering in awareness, consider AI dependencies in continuity and recovery, and track relevant risk indicators.
3. IAM	Treat bots and automated service accounts as identities with defined roles, provisioning, review, least privilege, and deprovisioning.
4. Networking and Cloud	Protect AI traffic, segment development and sensitive environments, use zero-trust principles, and understand cloud shared responsibility for AI workloads.
5. Operations and IR	Use monitoring and correlation without blindly trusting automation, protect sensitive data entered into AI services, and include AI tools and assets in change, lifecycle, incident, and testing processes.

AI can assist detection, correlation, and authentication analysis, but automated output still needs appropriate access control, context, validation, and human escalation. A confident automated result is still evidence to evaluate, not permission to bypass policy.

10. Decision rules for CC questions

Identify the level of the question

If the scenario asks what management should require, a policy or governance answer may fit better than a product. If it asks what should enforce a traffic boundary, a technical control may fit better than another document.

Prefer the control that matches the stated security objective

A confidentiality problem is not solved merely because a control improves availability. A permission problem is not primarily an authentication problem after identity has already been verified.

Use least privilege as a default access lens

Give the minimum access required for the approved purpose. Then add separation of duties when one identity should not control both sides of a sensitive process.

Protect the lifecycle, not only the starting point

Accounts need review and deprovisioning. Assets need maintenance and retirement. Cryptographic keys need protection throughout use. Changes need validation. Incident plans need exercises.

Follow established authority during incidents

The best answer is often the one that follows the Incident Response Plan, assigned responsibilities, evidence-handling rules, and business priorities rather than improvising an unapproved technical action.

Do not confuse visibility with prevention

Logging can provide evidence without blocking the event. A dashboard can summarize risk without fixing it. A vulnerability scan can identify a weakness without proving exploitation.

Cloud changes ownership boundaries, not the need for security

Ask which layer the provider operates and which responsibilities remain with the customer. Identity, data, configuration, and appropriate use remain important even in SaaS.

A security control can reduce risk without eliminating it

Residual risk remains. The relevant question is whether the remaining exposure is understood, monitored, and accepted by the proper authority.

For CAT questions, commit deliberately

You cannot use later items to come back and repair an earlier answer. Read the requirement, eliminate answers that solve a different problem, choose the strongest remaining fit, then move on.

11. Final readiness checklist

You are ready for another full practice set when you can explain these without relying on recognition alone:

[ ] Confidentiality, integrity, and availability from scenario clues
[ ] Authentication, authorization, accounting, non-repudiation, and privacy
[ ] Risk identification, assessment, treatment, residual risk, and monitoring
[ ] Law/regulation, framework, policy, standard, procedure, and guideline
[ ] Technical, administrative, and physical controls
[ ] Due care, due diligence, and professional ethics
[ ] Governance, risk management, and compliance as related but different functions
[ ] Business continuity versus disaster recovery
[ ] RTO versus RPO and why redundancy still needs planning and testing
[ ] Security awareness, culture, phishing, and social-engineering risk
[ ] KPI versus KRI, dashboards, scorecards, and reports
[ ] Identity role definition, provisioning, review, and deprovisioning
[ ] Least privilege versus separation of duties
[ ] RBAC, ABAC, DAC, and MAC decision rules
[ ] OSI/TCP/IP concepts, IP, VPN, ports/applications, wireless, IoT, and ICS
[ ] Segmentation, VLANs, microsegmentation, defense in depth, and zero trust
[ ] Five cloud characteristics, IaaS/PaaS/SaaS, deployment models, and shared responsibility
[ ] Classification, labeling, masking, and sanitization
[ ] Symmetric, asymmetric, hashing, digital signatures, and quantum-resistant cryptography
[ ] Monitoring, triage, threat actors, CTI, and threat frameworks
[ ] Incident plans, data handling, tabletop exercises, containment, recovery, and lessons learned
[ ] Asset lifecycle, EOL risk, configuration management, and change management
[ ] Vulnerability scanning, static analysis, dynamic analysis, threat modeling, and red/blue/purple teaming
[ ] How current AI scenarios reuse the same principles across all five domains
[ ] Why each incorrect answer in a practice question solves a different problem, acts at the wrong level, or grants too much trust

If several items are still slow, use the matching ISC2 CC Quick Review instead of rereading the entire course. Then take a fresh randomized CC practice test and see whether the repaired distinctions hold without prompts.