ISC2 Certified in Cybersecurity (CC) is an entry-level certification, but the revised outline still expects a learner to connect terminology to real security purposes. Knowing that a firewall filters traffic is useful. Knowing why segmentation limits exposure, why least privilege reduces unnecessary access, or why an incident exercise exposes response gaps is more useful.

This guide follows the CC exam outline effective September 1, 2026. That outline contains five domains and nineteen numbered objectives. Use the official outline as the coverage checklist, then use this guide to organize the concepts, identify distinctions that are easy to blur together, and decide where deeper review is needed.

If your exam is scheduled before September 1, 2026, use ISC2's outgoing outline instead. The domain names and scope differ enough that mixing the two versions can create avoidable study gaps.

1. ISC2 CC exam snapshot

The revised ISC2 outline describes the CC exam as computerized adaptive testing (CAT):

Effective outline
September 1, 2026
Exam time
2 hours
Number of items
100 to 125
Item format
Multiple choice and advanced item types
Passing grade
700 out of 1000 points

The five published domain weights range from 17.3% to 24%. Treat those weights as study-priority guidance rather than a reason to neglect a smaller domain. The outline still expects coverage across the full foundation.

Use the revised outline for exams on or after September 1, 2026. CertHappens CC material is organized around that version. Confirm current delivery and registration details with ISC2 before scheduling.

2. How to use this guide

A useful CC study cycle has four parts:

  1. Map the nineteen objectives. Mark each objective as comfortable, partly familiar, or unfamiliar. Start with the unfamiliar items, but do not stop reviewing an objective just because its vocabulary looks familiar.
  2. Learn the distinctions. CC repeatedly places related concepts near each other: authentication and authorization, business continuity and disaster recovery, least privilege and separation of duties, symmetric and asymmetric cryptography, or monitoring and incident response.
  3. Attach each term to a purpose. Ask what the concept protects, what risk it reduces, who uses it, and where it fits in a lifecycle or process.
  4. Review why alternatives are weaker. A plausible distractor often addresses a nearby problem. Identify which requirement makes one control, process, or action fit better than another.

Because CC is foundational, avoid turning the study plan into a product catalog. The outline emphasizes concepts, responsibilities, control purposes, and common security practices rather than vendor-specific configuration.

3. The 19-objective map

The revised outline contains nineteen numbered objectives across five domains.

Domain Weight Numbered objectives
1. Security Principles 24% 1.1 Cybersecurity concepts; 1.2 Risk management concepts; 1.3 Governance concepts; 1.4 Cybersecurity controls; 1.5 Professional and ethical conduct
2. Security Governance 17.3% 2.1 Governance, Risk, and Compliance (GRC); 2.2 Redundancy; 2.3 Security awareness; 2.4 Cybersecurity effectiveness
3. Identity And Access Management (IAM) Concepts 20% 3.1 Identity life cycle management; 3.2 Logical access controls
4. Networking and Cloud Security Concepts 21.3% 4.1 Network security; 4.2 Network security architecture; 4.3 Cloud security
5. Security Operations and Incident Response 17.3% 5.1 Data security; 5.2 Security operations; 5.3 Incident Response (IR); 5.4 Asset protection; 5.5 Security testing

4. Key distinctions worth learning early

Memorizing two definitions separately is less useful than knowing what separates them when both appear in the same scenario.

Concepts Useful distinction
Confidentiality, integrity, availability Confidentiality limits disclosure, integrity protects accuracy and authorized change, and availability keeps authorized access possible when needed.
Authentication, authorization, accounting Authentication verifies an identity or claimed identity, authorization determines permitted actions, and accounting records activity for review and accountability.
Policy, standard, procedure Policy sets direction, standards define mandatory requirements, and procedures describe how work is performed.
Due care and due diligence Due care is the responsibility to take reasonable and appropriate steps to protect people, assets, and interests from foreseeable harm. Due diligence is the ongoing process of investigating, verifying, monitoring, and documenting whether those safeguards remain appropriate and effective.
Business continuity and disaster recovery Business continuity keeps critical business functions operating through disruption, while disaster recovery restores technology and supporting capabilities after disruption.
Least privilege and separation of duties Least privilege limits a subject to the access needed for assigned work. Separation of duties divides sensitive responsibilities so one person does not control the entire process.
Symmetric, asymmetric, hashing Symmetric cryptography uses a shared secret key, asymmetric cryptography uses a related public/private key pair, and hashing produces a one-way digest rather than reversible ciphertext.
Segmentation and Zero Trust Segmentation separates network areas or workloads to limit reach and exposure. Zero Trust removes implicit trust based on location and makes access decisions around users, devices, resources, and policy.
Monitoring, triage, incident response Monitoring collects and observes security-relevant events, triage determines priority and meaning, and incident response coordinates actions once an event is handled as an incident.

5. The five ISC2 CC domains

Domain 1: Security Principles, 24%

Domain 1 supplies vocabulary and reasoning used everywhere else. The outline includes confidentiality, integrity, availability, Authentication, Authorization, Accounting (AAA), non-repudiation, privacy, risk management, governance concepts, cybersecurity controls, and professional conduct.

Study this domain by asking what each principle changes in a decision. If a scenario is about unauthorized disclosure, confidentiality is central. If a record must be trustworthy and protected from improper alteration, integrity matters. If a service must remain usable during disruption, availability becomes the priority.

The governance portion also expects you to distinguish laws and regulations from frameworks, policies, standards, and procedures. Controls are grouped as technical, administrative, and physical. Professional conduct includes due care, due diligence, professional codes of conduct, and the ISC2 Code of Ethics.

Review targets

  • Explain confidentiality, integrity, availability, AAA, non-repudiation, and privacy without treating them as interchangeable.
  • Recognize the purpose of a risk-management lifecycle and the role of governance requirements.
  • Distinguish technical, administrative, and physical controls by how they reduce risk.
  • Connect professional conduct to reasonable care, continuing diligence, and ethical obligations.

Open the Domain 1 Security Principles guide for the objective map, concept comparisons, risk lifecycle, governance hierarchy, control categories, ethics, exam traps, and review checklist.

Domain 2: Security Governance, 17.3%

Domain 2 moves from individual controls to organizational direction and resilience. Objective 2.1 covers Governance, Risk, and Compliance (GRC), including its purpose, importance, frameworks, and tools. The exam scope also includes business continuity, disaster recovery, security awareness, organizational culture, and measures of cybersecurity effectiveness.

Do not reduce awareness to an annual training event. The outline connects awareness to security culture and leadership as well as common human risks such as social engineering, weak password practices, and phishing.

Measurement matters because a security program needs evidence. Key metrics, Key Risk Indicators (KRI), dashboards, scorecards, and reports help communicate whether risk or control performance is changing.

Review targets

  • Explain why governance, risk, and compliance activities exist and how they guide security decisions.
  • Distinguish business continuity from disaster recovery.
  • Connect leadership and organizational culture to security awareness.
  • Recognize what metrics, KRIs, dashboards, scorecards, and reports are meant to communicate.

Open the Domain 2 Security Governance guide for GRC, redundancy, continuity and recovery, awareness and culture, effectiveness measures, exam traps, and a review checklist.

Domain 3: Identity And Access Management (IAM) Concepts, 20%

Domain 3 is compact but important. Objective 3.1 follows identity life cycle management through role definition, provisioning, review, and deprovisioning, with frameworks and tools supporting those activities. Objective 3.2 covers logical access controls, especially Principle of Least Privilege (PoLP), Separation of Duties (SoD), and access-control models.

Think in lifecycles rather than login screens. Access that was appropriate when a user joined may become excessive after a role change. An account that remains active after departure becomes a security problem even if the original provisioning was correct.

Review targets

  • Follow an identity from role definition through provisioning, periodic review, change, and deprovisioning.
  • Explain why least privilege limits unnecessary authority.
  • Explain why separation of duties reduces the risk of one person controlling a sensitive process.
  • Recognize that access-control models provide different ways to decide and enforce who may access what.

Open the Domain 3 Identity And Access Management guide for lifecycle management, role changes, provisioning and deprovisioning, logical access controls, access models, exam traps, and a review checklist.

Domain 4: Networking and Cloud Security Concepts, 21.3%

Domain 4 combines network foundations with security architecture and cloud concepts. The outline names the Open Systems Interconnection (OSI) model, Transmission Control Protocol/Internet Protocol (TCP/IP) model, Internet Protocol version 4 (IPv4), Internet Protocol version 6 (IPv6), Virtual Private Networks (VPN), firewalls, ports, applications, Wi-Fi, Bluetooth, Industrial Control Systems (ICS), and Internet of Things (IoT).

Architecture topics include firewall zones, Virtual Local Area Networks (VLAN), micro-segmentation, defense in depth, and Zero Trust. Cloud security includes the five familiar cloud characteristics, service models, deployment models, and shared security roles and responsibilities.

Use the Ports and Protocols reference for service and firewall context, and the IPv6 Addressing reference when address structure is the weak point.

Review targets

  • Recognize what the OSI and TCP/IP models help describe without memorizing them as isolated layer lists.
  • Connect ports and applications to firewall decisions.
  • Explain how segmentation limits reach between systems or security zones.
  • Distinguish defense in depth from Zero Trust.
  • Know the cloud characteristics, service models, deployment models, and shared security responsibilities.

Open the Domain 4 Networking and Cloud Security guide for network models, IP, VPNs, wireless and embedded systems, segmentation, Zero Trust, cloud models, exam traps, and a review checklist.

Domain 5: Security Operations and Incident Response, 17.3%

Domain 5 is broad. Data security includes classification, labeling, masking, sanitization, symmetric and asymmetric cryptography, hashing, and quantum-resistant cryptography. Operations includes logging, monitoring, event triage, prioritization, correlation, threat actors, cyber threat intelligence, and threat frameworks.

Incident response includes data-handling policy, the Incident Response Plan (IRP), and exercises such as testing and tabletops. Asset protection covers lifecycle management, End Of Life (EOL) software and devices, configuration management, and change management. Security testing includes blue, purple, and red teaming; vulnerability scanning; static and dynamic analysis; threat modeling; and physical penetration testing.

This domain is easier when you keep the purpose of each activity in view. Logging creates evidence. Triage decides what deserves attention. Incident response coordinates action. Change management reduces uncontrolled change. Testing seeks weaknesses before an adversary or failure exposes them.

Review targets

  • Distinguish encryption from hashing and understand why data classification affects handling.
  • Connect logging, monitoring, correlation, and triage to operational decisions.
  • Know why incident-response exercises are performed before a real incident.
  • Identify risks created by unsupported or end-of-life assets.
  • Distinguish major testing approaches by what they examine and what kind of evidence they produce.

Open the Domain 5 Security Operations and Incident Response guide for data security, monitoring and threat intelligence, incident response, asset lifecycle, security testing, exam traps, and a review checklist.

6. A practical CC study plan

The five domain weights are close enough that a balanced plan works better than spending most of the schedule on a single favorite topic.

  1. Build the common vocabulary. Start with Domain 1 and the identity concepts in Domain 3. These terms recur in governance, networking, cloud, operations, and incident scenarios.
  2. Add organizational context. Work through Domain 2 so policies, GRC, continuity, recovery, awareness, and measurement have a clear purpose.
  3. Strengthen the technical foundation. Use Domain 4 to connect network models, ports, segmentation, Zero Trust, wireless, embedded systems, and cloud models to security outcomes.
  4. Finish with operations and response. Domain 5 ties data handling, cryptography, monitoring, threats, incidents, asset lifecycle, and testing into day-to-day security work.
  5. Run a second pass by weakness, not domain order. Revisit the objectives you still confuse, especially concept pairs that produce plausible wrong answers.

A short review session can focus on one distinction rather than an entire domain. For example, compare authentication, authorization, and accounting; then write one sentence describing when each matters. Repeat the same exercise for business continuity and disaster recovery, least privilege and separation of duties, or symmetric encryption and hashing.

7. Official and primary references

Use the ISC2 outline as the authoritative scope for this version of the exam:

Primary references from the National Institute of Standards and Technology (NIST) can add depth for concepts named in the outline:

These supporting references are useful for understanding the concepts. They do not replace the ISC2 exam outline as the coverage checklist.

CertHappens is an independent study resource and is not affiliated with or endorsed by ISC2.

ISC2 CC Certification Overview Review candidate fit, exam format, the September 2026 transition, and the five revised domains. ISC2 CC September 2026 Practice Test Build a randomized session from the approved question bank and review detailed explanations after finishing. Domain 1: Security Principles Study cybersecurity concepts, risk management, governance, control categories, ethics, due care, and due diligence in depth. Domain 2: Security Governance Study GRC, redundancy, continuity and recovery, security awareness and culture, metrics, KRIs, dashboards, and reporting. Domain 3: Identity And Access Management (IAM) Concepts Study identity lifecycle management, provisioning, access reviews, deprovisioning, least privilege, separation of duties, and access-control models. Domain 4: Networking and Cloud Security Concepts Study network models, IP, VPNs, firewalls, wireless and embedded systems, segmentation, Zero Trust, cloud models, and shared responsibilities. Domain 5: Security Operations and Incident Response Study data protection, monitoring and threat intelligence, incident response, asset lifecycle, change management, and security testing. Security+ or ISC2 CC Compare the certifications by starting point, technical breadth, and the foundation each one is meant to demonstrate. Ports and Protocols Review common ports, protocols, transport choices, and secure alternatives used in network-security discussions. IPv6 Addressing Reference Review IPv6 structure and special-use address ranges before applying them in network-security scenarios.