CC
Certified in Cybersecurity
Certified in Cybersecurity Exam Guide: Domains, Preparation Plan, and Scheduling Decisions
The ISC2 Certified in Cybersecurity (CC) exam validates foundational knowledge across security principles, resilience, access controls, network security, and security operations. It is designed for people entering cybersecurity, including career changers, students, recent graduates, and IT professionals without prior cybersecurity work experience. This guide helps you decide whether the CC matches your starting point, how to sequence study against the current blueprint, when to schedule, and what administrative steps remain after passing.
What the CC exam is intended to validate
The CC is an entry-level certification for candidates building a foundation in cybersecurity rather than proving extensive professional experience. ISC2 states that no work experience is required and describes the credential as evidence of foundational knowledge, skills, and abilities for an entry- or junior-level cybersecurity role.
The exam is also a useful orientation test for people still choosing a direction. Its coverage is broad: candidates encounter security concepts, risk, continuity and response, access decisions, networking, data protection, hardening, and everyday security operations. That breadth can help you identify whether you prefer governance, infrastructure, response, or operational work.
Treat the certification as a knowledge baseline, not a substitute for hands-on experience. A passing result does not by itself demonstrate that you have administered a firewall, investigated a live incident, or operated an identity platform. During preparation, connect each concept to a simple workplace scenario so that your knowledge remains usable after the exam.
Who benefits most from this certification
ISC2 identifies IT professionals, career changers, college students, and recent graduates as suitable audiences. The official self-study resource also describes the credential as appropriate for people entering the field without direct IT experience. That makes the CC a reasonable first certification when you need a structured introduction rather than a specialist credential.
Candidates with an IT background should not assume that familiarity with computers covers the whole blueprint. Networking knowledge may help in Network Security, but risk treatment, business continuity, access governance, and security operations still require deliberate study. Candidates without IT experience should first build basic vocabulary, then work through the domains in the order recommended below.
Check the current outline before you build a study plan
Use the current ISC2 CC Exam Outline as the controlling document for preparation. The research snapshot identifies the current outline as effective October 1, 2025, and ISC2 states that a new outline will take effect on September 1, 2026. Candidates scheduling near that change should confirm which outline applies to their appointment before relying on older notes or practice material.
The outline is more useful than a list of broad topic names. Read each domain objective, mark terms you can explain without notes, and create a separate list for terms that you recognize but cannot apply. That distinction prevents a common error: mistaking familiarity with a glossary word for readiness to answer a scenario-based question.
Official self-study resources include the exam outline and CC flash cards. Use the outline to define scope and flash cards for retrieval practice. Third-party explanations can clarify difficult concepts, but they should not replace checking every study topic against the official outline.
The five domains and their measured weights
The current CC blueprint assigns 26% to Security Principles, 10% to Business Continuity (BC), Disaster Recovery (DR) and Incident Response Concepts, 22% to Access Controls Concepts, 24% to Network Security, and 18% to Security Operations. Plan study time around both the weight and your personal gaps; the smallest domain still needs complete coverage.
How to interpret the percentages
Security Principles is the largest domain at 26%, so it deserves early study and repeated review. Network Security accounts for 24%, while Access Controls Concepts accounts for 22%; these domains commonly reward understanding how controls work rather than memorizing isolated definitions. Security Operations represents 18%, and Business Continuity, Disaster Recovery and Incident Response Concepts represents 10%. These percentages describe the blueprint domains, not a guaranteed count of questions.
Do not convert the weights into a personal pass formula. The exam uses Computerized Adaptive Testing, and the official outline gives a passing grade of 700 out of 1,000 points; a candidate cannot safely assume that a strong result in one domain compensates for ignoring another.
What to learn in each CC domain
Study each domain as a connected set of decisions: what must be protected, which risk matters, which control reduces it, how the organization continues operating, and how security staff respond. The following sequence turns the outline into practical study targets without implying access to live exam questions.
Security Principles
Security Principles covers information assurance concepts including confidentiality, integrity, availability, authentication, multifactor authentication, non-repudiation, and privacy. It also addresses risk management, including identifying, assessing, prioritizing, and treating risk. Build a comparison table for these concepts and attach a short example to each one.
Practice distinguishing a security objective from a control. Confidentiality is an objective; access restrictions, encryption, or another safeguard may support it. Similarly, risk treatment is a management decision, while a technical configuration may be one way to reduce exposure. This separation makes ambiguous questions easier to analyze.
Business Continuity, Disaster Recovery and Incident Response Concepts
This domain asks you to distinguish the purpose and key components of business continuity, disaster recovery, and incident response. Study how the three activities relate without treating them as interchangeable. A continuity plan supports ongoing critical business functions, disaster recovery addresses restoration after disruption, and incident response organizes the handling of a security event.
Use one disruption scenario to test the boundaries. Ask what must happen immediately, what capability the organization must preserve, what systems require restoration, and which lessons should update future planning. The official outline also incorporates how AI can complicate and enhance organizational resilience, so review the current objective wording rather than relying only on older introductory material.
Access Controls Concepts
Access Controls Concepts covers the distinction between physical and logical access controls and the principles used to limit access to resources. Study identification, authentication, authorization, and accountability as separate steps. Then review how least privilege, separation of duties, and access reviews reduce the consequences of inappropriate access.
For each control, ask who receives access, to what resource, for which purpose, and how the organization verifies that access remains appropriate. This approach is more useful than memorizing a catalogue of technologies. It also helps you identify whether a situation involves a facility, an account, a device, an application, or data.
Network Security
Network Security requires enough networking knowledge to assess vulnerabilities, recognize preventative mechanisms, and understand the security posture of network infrastructure. Review common network components, traffic movement, segmentation, secure communications, monitoring, and basic threat-prevention ideas. The current outline also addresses how AI influences traffic monitoring and threat prevention.
Draw simple network diagrams while studying. Place users, endpoints, servers, security devices, and trust boundaries on the page, then ask where an attacker could move and which control would limit that movement. If you cannot explain why a control belongs at a particular location, return to the underlying networking concept before memorizing the control name.
Security Operations
Security Operations focuses on day-to-day security work, including data security concepts and policies, system hardening, security awareness training, and responding to security threats. Review how operational procedures turn policy into repeatable activity. The current outline also refers to security professionals working alongside AI, so include the stated objective in your notes.
Build a small operations checklist for a hypothetical organization. Include asset and data handling, secure configuration, awareness activity, monitoring, reporting, and response escalation. Then identify which activity protects confidentiality, integrity, or availability. This exercise exposes gaps between knowing a term and understanding how several controls work together.
A preparation strategy that works with uneven background knowledge
Start with diagnosis, not calendar pressure. Take an initial quiz or work through the official topic list without looking up answers, then classify each subject as strong, familiar, or unknown. Spend the first pass learning the unknown areas, the second pass applying them to scenarios, and the final pass retrieving them under time pressure. Use practice questions to reveal reasoning gaps, not to memorize answer patterns.
A useful study session has three parts: learn a limited topic, retrieve it from memory, and explain why an answer is correct or incorrect. Keep an error log with the domain, the concept tested, the mistaken assumption, and the corrected rule. Review that log at the start of the next session. This produces more actionable feedback than recording only a percentage.
Candidates with no IT background should begin with networking, operating-system, identity, and data-handling vocabulary before attempting dense security explanations. Candidates with IT experience can move faster through those foundations but should spend extra attention on governance language, risk decisions, continuity planning, and the difference between a policy, a procedure, and a technical control.
Use official material as the scope boundary
ISC2 provides the exam outline, official flash cards, and self-study resources. Use these materials to decide what belongs in your plan. The official online self-paced training includes pre- and post-course assessments, knowledge checks, end-of-domain quizzes, study sheets, interactive content, flash cards, and a glossary. Those features can support a structured plan, but purchasing training is not an official requirement for taking the exam.
Choose training access around your real schedule
Official online self-paced training is available with 90-day and 180-day access options, and access starts at purchase. The 90-Day Online Self-Paced Training access lasts 90 days from the purchase date; the 180-Day option lasts 180 days from the purchase date. Choose based on the time you can consistently study, not on an optimistic completion date.
Adaptive training is available only in English; the other listed training versions use a linear format. The training content is available in English, Chinese, German, Spanish, and Japanese. If your preferred study language is not English, account for the different learning format when deciding whether the product suits your preparation style.
A practical six-phase study roadmap
Use the roadmap as a sequence, not as a promise that every candidate needs the same number of sessions. Move forward when you can explain the objectives and correct your mistakes without immediately consulting notes. If a phase exposes a major gap, extend that phase rather than protecting an arbitrary exam date.
Phase 1: Establish the baseline
Read the current outline once from beginning to end. Create one page for each domain and list every objective in your own words. Take a diagnostic quiz if you have one from a reputable source, but record the concepts behind missed answers. Do not use diagnostic performance as a prediction of the official result.
At the end of this phase, decide whether you need a fundamentals-first route or a blueprint-first route. The fundamentals-first route is appropriate when identity, networking, or basic systems language is unfamiliar. The blueprint-first route suits candidates who already work with IT and mainly need to organize cybersecurity concepts.
Phase 2: Build the conceptual base
Study Security Principles first, then Access Controls Concepts and Network Security. This order establishes the objectives, actors, assets, and technical environment that later domains rely on. Make short comparison tables for confidentiality versus privacy, authentication versus authorization, continuity versus recovery, and policy versus procedure.
Avoid copying long notes. Write a definition, a purpose, a practical example, and one likely confusion for each important term. If you cannot produce the example without looking at the source, the topic is not yet ready for passive review only.
Phase 3: Add resilience and operations
Study Business Continuity, Disaster Recovery and Incident Response Concepts after the foundation, then complete Security Operations. Use a single fictional organization so that planning, response, access, network, and operational controls remain connected. For every scenario, identify the business objective, the security concern, the control, and the responsible activity.
Include the current AI-related wording where it appears in the outline. The goal is not to predict a question about a particular product. The goal is to understand how automation or intelligent systems can affect resilience, monitoring, threat prevention, and day-to-day security work.
Phase 4: Apply rather than reread
Replace a portion of reading time with scenario analysis. For each practice item, identify the requested action, eliminate options that solve a different problem, and state why the remaining choice best matches the stated objective. If two options appear plausible, identify the control scope, risk priority, or lifecycle stage that separates them.
Do not treat repeated exposure to the same question bank as proof of readiness. Memorizing wording can conceal a vocabulary gap. Rewrite missed questions as fresh scenarios and answer them without the original choices. Use only legitimate study resources; leaked questions and exam dumps are not a reliable or appropriate preparation method.
Phase 5: Close domain gaps
Return to the official domain list and mark each objective as explainable, partially understood, or unresolved. Give unresolved objectives priority even when their domain has a smaller blueprint weight. Then revisit the two largest current domains—Security Principles at 26% and Network Security at 24%—without neglecting Access Controls Concepts at 22%, Security Operations at 18%, or Business Continuity, Disaster Recovery and Incident Response Concepts at 10%.
Build a final review sheet from errors, not from every page of your course. Include confusing pairs, control purposes, response sequences, and terms you repeatedly misapply. A compact error-based sheet is easier to retrieve than a rewritten textbook.
Phase 6: Rehearse the decision process
In the final stage, complete mixed-domain practice under conditions that require sustained concentration. Review explanations after each set, including questions answered correctly for the wrong reason. Stop adding new resources when they produce more terminology than understanding.
Schedule only when you can demonstrate consistent reasoning across all domains and explain your weak areas. The official passing grade is 700 out of 1,000 points, but practice scores from unofficial material are not equivalent to the official scaled result. Use them to guide study decisions, not to guarantee an outcome.
How to schedule without losing the exam opportunity
After purchasing an ISC2 exam, candidates have up to 365 days from the purchase date to schedule and sit for it. Schedule when your preparation evidence supports the decision, while leaving enough time for a deliberate final review. Do not buy early merely to create pressure if your available study time is uncertain.
To schedule, log into the ISC2 account, open Courses and Exams, and select Schedule. You will complete the ISC2 Exam Account Information form and then be redirected to Pearson VUE. Enter your details exactly as they appear on the identification you will present; an exact mismatch can prevent you from taking the test without reimbursement.
ISC2 states that its exams are offered at Pearson VUE testing centers worldwide. The CC exam is listed in English, Chinese, Japanese, German, and Spanish, with Chinese appointments available only during select windows. Check the actual appointment options in your region before choosing an exam language or committing to a date.
Understand the tested format
The current CC exam uses Computerized Adaptive Testing, lasts 2 hours, contains 100-125 items, and uses multiple-choice and advanced item types. The passing grade is 700 out of 1,000 points. Prepare to read carefully, identify the best answer for the stated problem, and manage uncertainty without assuming that every question can be solved through recall alone.
The outline also lists annual availability windows. Because scheduling availability and the applicable outline can change, verify the current appointment information with ISC2 and Pearson VUE before making a travel or timing decision.
Rescheduling and cancellation choices
Exams cannot be rescheduled within 24-hours of the appointment. To reschedule, log into the ISC2 account, visit Courses and Exams, select Reschedule beside the exam, review the account information, and continue to Pearson VUE. From the Pearson VUE dashboard, select the exam, then choose Reschedule or Cancel on the Exam Appointment Details screen.
ISC2 lists a U.S. $50 rescheduling fee and a U.S. $100 cancellation fee. If you do not sit for the exam within 365 days of the purchase date, the exam fee will not be refunded. Candidates participating in ISC2’s One Million Pledge who sit for the CC exam for the first time by December 31, 2026 do not pay rescheduling fees; confirm eligibility directly with ISC2.
When an exam bundle changes the plan
Some official CC options include Peace of Mind Protection with two exam attempts. The associated official training information states that candidates have 180 days from purchase to sit both attempts, with a 30-day waiting period between attempts. Treat the second attempt as a recovery option, not as permission to schedule before you are prepared; the waiting period affects how quickly you can act on a first-attempt result.
What happens after passing
Passing the exam is not the only administrative step. All candidates who pass an ISC2 credential examination must complete the certification application process within nine months of the exam date, and the application cannot be submitted until ISC2 sends notification of the successful result.
For CC specifically, there is no work-experience requirement in the endorsement application. The application includes questions and agreements concerning adherence to the ISC2 Code of Ethics and privacy policy. Read those obligations before applying so that the post-exam process is a planned step rather than an unexpected formality.
After the certification application is approved, ISC2 describes payment of the first Annual Maintenance Fee as the final step toward membership. The candidate policy states that the CC Annual Maintenance Fee is U.S. $50 annually. Confirm the current policy and account instructions when you receive your application decision, since fees and administrative rules can change.
Keep candidate and certified status separate
Candidate status and CC certification are different stages. ISC2 candidate policies state that candidates must follow the Code of Ethics and privacy policy and pay candidate annual dues beginning in the candidate’s second year while candidate status is held. Candidates are not required to submit CPE credits, and there is no term limit for candidate status while dues remain current.
Do not assume that passing automatically completes endorsement. Save your passing notification, monitor the application instructions, and submit within the stated nine-month period. If ISC2 selects an application for audit, the endorsement page states that additional information may be required for verification.
Common preparation mistakes and better replacements
Most avoidable problems come from studying the wrong target, confusing related concepts, or ignoring administrative constraints. Correct them by tying every study activity to an objective, an explanation, or an error pattern. A plan that produces understanding is more valuable than one that merely accumulates hours.
Mistake: studying from an outdated outline
The current outline is effective October 1, 2025, and ISC2 has announced a new outline effective September 1, 2026. Replace old notes with the outline that applies to your exam. If your appointment is near the transition, confirm the applicable version before buying or relying on preparation material.
Mistake: treating weights as a permission to skip domains
A 10% domain is still part of the exam. Study Business Continuity, Disaster Recovery and Incident Response Concepts to full objective coverage, then allocate additional review time to weaknesses in the higher-weight domains. Never compare bare percentages without keeping their official domain labels attached.
Mistake: memorizing definitions without choosing controls
Definition recall is necessary but insufficient for scenario decisions. After learning a term, ask what problem it addresses, what it does not address, where it operates, and how it differs from the closest alternative. This is especially important for access control, risk treatment, continuity, recovery, and response concepts.
Mistake: scheduling before checking identity and deadlines
Enter appointment information exactly as it appears on your identification, track the 365-day purchase-to-exam limit, and avoid changes inside the 24-hour rescheduling restriction. Put the purchase date, appointment date, cancellation rules, and any bundle deadline in one calendar entry.
Mistake: using exam dumps as a shortcut
Unauthorized question collections cannot establish that you understand the blueprint and may expose you to inaccurate or compromised material. Use the official outline, ISC2 flash cards, legitimate training, and practice questions that explain the reasoning. No memorization resource can guarantee a passing result.
Make the final readiness decision
Schedule when you can explain every current domain in plain language, apply the concepts to unfamiliar scenarios, and identify a concrete correction for each recurring error. If your weaknesses are concentrated in one domain, extend study and reassess rather than relying on strong familiarity elsewhere.
Before booking, confirm the current outline, exam language, Pearson VUE availability, identification details, purchase deadline, and any applicable fees or bundle conditions. After booking, reserve the final review for error analysis and mixed-domain practice. On the administrative side, keep the post-passing endorsement deadline visible so the certification application does not become an afterthought.
The CC is best approached as a foundation-building decision: it can organize entry-level cybersecurity study and demonstrate baseline knowledge, but your next career step should also include practical exposure to systems, networks, identity, monitoring, or response. Use the exam preparation process to identify the area in which you will build that next layer of capability.
Conclusion
A sound CC plan combines the official outline with deliberate practice and careful scheduling. Learn the five domains, give each its official context and weight, correct reasoning errors, and verify the current rules before purchasing or booking. Passing then leads to an endorsement application rather than an end point; use the certification as a structured baseline while continuing to develop practical cybersecurity skills.
Related exams
- CSSLP exam — Certified Secure Software Lifecycle Professional
- ISSAP Information Systems Security Architecture Professional
- ISSEP Information Systems Security Engineering Professional
- Information Systems Security Management Professional (ISSMP) Exam