Learnerside

certification

Start with security.

Compare self-paced and live instruction, exam eligibility and continuing costs. Check the selected access and support.

Ask about security training

Free offer status · checked October 9, 2026

Is the ISC2 CC exam still free?

Not for new enrollments through ISC2's former One Million Certified in Cybersecurity program. ISC2 closed that free-course-and-exam program to new participants on May 20, 2026. The CC certification and exam remain available through the regular paid route.

If you already received a program exam code, check its expiration in your ISC2 account. An unexpired code can be used to schedule and take the exam by December 31, 2026. People enrolled in the course before May 20 can use it only while their course access remains valid. A free exam outline or flash cards do not give a new learner a free exam seat.

Read the current official CC outline, and confirm selected exam pricing and any existing entitlement. Reading or completing training is not a prerequisite for asking for help. Read ISC2's program closure and existing-code terms.

Choose security instruction

Compare adaptive self-study with live dialogue and scenarios. No security work experience is required for the exam; basic IT knowledge is recommended. Starting a course does not establish exam or workplace readiness.

Build a private security-training brief

CC Online Self-Paced Training

ISC2 · Course outline reference · Observed 2026-10-09

No prerequisites stated for students, entry-level professionals and career-changers. The exam separately recommends basic IT knowledge; no work experience is required. Course entry does not establish exam or workplace readiness.

Purchased ninety- or one-hundred-eighty-day course access starts at purchase. Exam bundles have separate attempt and validity terms; selected tuition, bundle, seat, access and feedback unknown. No new free programme enrolment assumed. Selected tuition, seat, contact time, permitted practice and feedback remain unverified; a dated outline is not a current offer.

Read instruction and completion limits

Foundational security controls; governance and risk management; ethics; continuity and redundancy; security awareness; identity lifecycle; logical access controls; network architecture; cloud security models; data security; incident response planning; asset protection; security testing concepts

Adaptive instruction advertises knowledge checks, domain quizzes, pre/post assessments, interactive content, study materials and email content support. English only. No fixed study hours or deployed lab verified. Validation requires seventy-five percent for each domain and final assessment, acknowledgement and evaluation; not the exam seven-hundred-out-of-one-thousand score. Validation is valid three years and expressly does not establish competence, expertise or accreditation. Trailing experience-requirements template conflicts with credential no-work-experience policy; no experience gate inferred. Education guarantee repeats the same course after first exam failure within one year of initial training end; does not pay an exam retake. No refunds; extensions are paid. Selected delivered edition, practical access, feedback and complete current alignment unknown.

CC Online Instructor-Led Training

ISC2 · Course outline reference · Observed 2026-10-09

The captured live-course page does not state specific entry requirements. Credential eligibility requires no work experience and recommends basic IT knowledge; this is separate from course admission and readiness.

Training-only and training-plus-exam options advertised. Materials and recordings have one-hundred-eighty-day access from the first live session, accessible up to one week before. Selected tuition, seat, session, instructor, exam inclusion and feedback unknown. Selected tuition, seat, contact time, permitted practice and feedback remain unverified; a dated outline is not a current offer.

Read instruction and completion limits

Instructor dialogue; cybersecurity scenarios; practice questions; reflection activities; domain quizzes

Provider advertises authorized live instruction, digital textbook, study questions book with over three hundred questions, workbook, learning activities, study plan, assessments, recordings and technical support. Latest-outline coverage is a publisher claim; detailed taught topic and deployed lab bodies unrecovered. Do not borrow self-paced learning outcomes or exam objectives as this live syllabus. Catalogue has three-day and six-week schedule headings, but the six-week November three to December seventeen row says three-day; selected duration, dates, timezone and contact hours require confirmation. Education guarantee covers another course, not another exam. Self-paced seventy-five-percent completion rules are not verified for live instruction. Selected delivered edition, practice entitlement, feedback and complete current alignment unknown.

The current exam uses adaptive testing: two hours, 100–125 items and a 700/1000 passing score. Self-paced course completion uses different 75% assessments. Neither the course validation nor an original practice exercise proves readiness.

Read exam, promotion and maintenance references

ISC2 CC credential and no-work-experience eligibility

Credential lifecycle reference · Observed 2026-10-09

No work experience required; basic IT knowledge recommended in the current English outline. Exam eligibility is separate from professional readiness.

This public credential notice is a version and timing reference, not purchased instruction or a seat. Exam registration, courses and permitted practice have separate costs.

ISC2 CC September 1, 2026 English exam outline

Exam objective reference · Observed 2026-10-09

Eight-page English outline effective September 1, 2026. Current rounded weights 24/17.3/20/21.3/17.3 sum 99.9 although issuer total says 100. CAT two hours, one hundred to one hundred twenty-five items, seven hundred of one thousand passing score; listed languages English/Chinese/Japanese/German/Spanish. Objectives are not a course syllabus.

This public exam outline is a scope reference, not purchased instruction or practice access. Exam registration, courses and permitted practice have separate costs.

ISC2 One Million CC programme closure and existing participant limits

Official research reference · Observed 2026-10-09

New enrolments ended May 20, 2026. Previously issued unexpired codes may be scheduled and used by December 31, 2026; expired codes are not revived. Pre-May-20 course enrolment only remains usable while its access is unexpired. Course completion is not required to sit the exam. No new free course or exam seat inferred.

Selected price and currency, dates, seats and practice access require confirmation in the source and owning guide.

ISC2 CC regional exam pricing

Official research reference · Observed 2026-10-09

CC exam USD 199 in Americas, Asia Pacific, Middle East and Africa; EMEA EUR 191.04 and UK GBP 161.19 before applicable location-based tax. Selected checkout and course tuition unknown.

Selected price and currency, dates, seats and practice access require confirmation in the source and owning guide.

ISC2 certification maintenance policy version 7.0

Official research reference · Observed 2026-10-09

Version 7.0: CC-only members pay USD 50 at cycle start and subsequent annual anniversaries; application approval and first AMF required before certification. Forty-five Group A CPE credits required over three years; fifteen annually is suggested. Other ISC2 certifications have separate AMF rules. USD 349 is only an exam plus three annual USD 50 fees illustration excluding tuition, tax, retakes and extensions.

Selected price and currency, dates, seats and practice access require confirmation in the source and owning guide.

Explore ten original learning questions

These Learnerside recognition questions are optional and fictional. They are not official exam items, a readiness score or permission to act on real systems.

Security Principles

A beginner reviews a fictional clinic's plan to restrict who can read patient records. Which security principle does this safeguard primarily support?

  • Confidentiality: only authorized people should read the records.
  • Availability: every person should have unrestricted access.
  • Integrity: the records must never be backed up.
  • Non-repudiation: a shared account should hide who reads them.
Compare the explanation

Suggested answer: Confidentiality: only authorized people should read the records.

Confidentiality protects information from unauthorized disclosure. Integrity addresses unauthorized alteration, and availability addresses access when needed. This original recognition exercise maps to the September 1, 2026 Security Principles domain, not independent control-design authority.

Security Principles

An entry-level security analyst is handling a readiness review where the team must prove that controls work in realistic operating conditions. Which response best demonstrates CC - Certified in Cybersecurity readiness for Security Principles?

  • Review scope, assumptions, control behavior, evidence quality, exceptions, residual risk, and follow-up actions.
  • Use a policy name as proof that the control is operating.
  • Skip stakeholder review because the control is technical.
  • Treat residual risk as closed when the initial checklist is complete.
Compare the explanation

Suggested answer: Review scope, assumptions, control behavior, evidence quality, exceptions, residual risk, and follow-up actions.

The current ISC2 exam outline includes Security Principles with 24% objective weight. This foundational cybersecurity scenario checks whether the candidate can apply the domain to operating decisions and evidence.

Security Governance

An entry-level security analyst is reviewing a new control that affects employees, systems, and regulated data. Which response best demonstrates CC - Certified in Cybersecurity readiness for Security Governance?

  • Connect the control to policy, legal and regulatory duties, assigned ownership, risk treatment, and review evidence.
  • Approve the control because the technology is widely used.
  • Leave ownership undefined until an audit requests it.
  • Treat a written policy as proof that the control operates.
Compare the explanation

Suggested answer: Connect the control to policy, legal and regulatory duties, assigned ownership, risk treatment, and review evidence.

The current ISC2 exam outline includes Security Governance with 17.3% objective weight. This foundational cybersecurity scenario checks whether the candidate can connect governance requirements to operating decisions and evidence.

Security Governance

An entry-level security analyst is reviewing how an organization manages security risk across policies, standards, procedures, and assigned responsibilities. Which response best demonstrates CC - Certified in Cybersecurity readiness for Security Governance?

  • Trace the requirement from policy to accountable owners, operating procedures, control evidence, exceptions, and periodic review.
  • Treat every policy statement as a technical configuration requirement.
  • Allow each team to define risk acceptance without an accountable owner.
  • Skip exception records when a deadline is urgent.
Compare the explanation

Suggested answer: Trace the requirement from policy to accountable owners, operating procedures, control evidence, exceptions, and periodic review.

The current ISC2 exam outline includes Security Governance with 17.3% objective weight. This foundational cybersecurity scenario checks whether the candidate can connect governance requirements to operating decisions and evidence.

Identity and Access Management (IAM) Concepts

A fictional employee changes from billing to customer support. Which access-lifecycle choice best follows least privilege?

  • Review the new role's approved permissions and remove billing access that is no longer needed.
  • Keep all old permissions because the employee still works here.
  • Give administrator rights to avoid future access requests.
  • Share a coworker's account instead of reviewing the employee's access.
Compare the explanation

Suggested answer: Review the new role's approved permissions and remove billing access that is no longer needed.

A mover event requires reviewing permissions for the new role and revoking unnecessary old access. Least privilege is not permanent accumulation of rights. This original IAM-concept exercise asks the learner to recognize the appropriate change, not administer a real identity system.

Identity and Access Management (IAM) Concepts

An entry-level security analyst is handling a federated access design where internal users, contractors, and service accounts need different controls. Which response best demonstrates CC - Certified in Cybersecurity readiness for Identity and Access Management (IAM) Concepts?

  • Separate identity types, authorization paths, credential controls, lifecycle ownership, and audit evidence.
  • Use the same access profile for all authenticated identities.
  • Approve contractor access without an owner or expiration.
  • Treat service accounts as exempt from review.
Compare the explanation

Suggested answer: Separate identity types, authorization paths, credential controls, lifecycle ownership, and audit evidence.

The current ISC2 exam outline includes Identity and Access Management (IAM) Concepts with 20% objective weight. This foundational cybersecurity scenario checks whether the candidate can apply the domain to operating decisions and evidence.

Networking and Cloud Security Concepts

An entry-level security analyst is handling remote and internal traffic crossing network and cloud zones with different trust levels. Which response best demonstrates CC - Certified in Cybersecurity readiness for Networking and Cloud Security Concepts?

  • Validate segmentation, secure protocols, routing exposure, inspection points, access paths, and monitoring evidence.
  • Permit traffic because both endpoints are owned by the organization.
  • Rely only on endpoint antivirus for network control.
  • Review packet flow without considering identity or data sensitivity.
Compare the explanation

Suggested answer: Validate segmentation, secure protocols, routing exposure, inspection points, access paths, and monitoring evidence.

The current ISC2 exam outline includes Networking and Cloud Security Concepts with 21.3% objective weight. This foundational cybersecurity scenario checks whether the candidate can apply the domain to operating decisions and evidence.

Networking and Cloud Security Concepts

An entry-level security analyst is handling a connectivity change that introduces partner access to an internal or cloud service. Which response best demonstrates CC - Certified in Cybersecurity readiness for Networking and Cloud Security Concepts?

  • Assess authentication, encryption, least privilege, traffic filtering, logging, and third-party risk controls.
  • Use a broad allow rule until the partner confirms testing is complete.
  • Skip monitoring because the connection is encrypted.
  • Treat partner connectivity as a routing-only task.
Compare the explanation

Suggested answer: Assess authentication, encryption, least privilege, traffic filtering, logging, and third-party risk controls.

The current ISC2 exam outline includes Networking and Cloud Security Concepts with 21.3% objective weight. This foundational cybersecurity scenario checks whether the candidate can apply the domain to operating decisions and evidence.

Security Operations and Incident Response

A beginner sees an unexpected login alert in a fictional workplace exercise. What is the appropriate first response within an established reporting role?

  • Record the observed facts and promptly escalate through the incident plan without altering potential evidence.
  • Erase the logs so a possible attacker cannot read them.
  • Independently shut down all systems without authorization.
  • Assume the event is resolved when the alert stops.
Compare the explanation

Suggested answer: Record the observed facts and promptly escalate through the incident plan without altering potential evidence.

An alert is not by itself a confirmed incident. Follow the assigned role and response plan: capture facts, report promptly and preserve evidence. Containment belongs to authorized responders. This original exercise assesses recognition and escalation, not production incident-response authority.

Security Operations and Incident Response

An entry-level security analyst is handling a resilience exercise where recovery plans, backups, communications, and business priorities are tested. Which response best demonstrates CC - Certified in Cybersecurity readiness for Security Operations and Incident Response?

  • Validate recovery objectives, plan execution, escalation paths, backup integrity, dependency mapping, and improvement actions.
  • Assume backups are usable because jobs report success.
  • Test only the technical restore and skip business communications.
  • Keep recovery lessons informal to avoid audit findings.
Compare the explanation

Suggested answer: Validate recovery objectives, plan execution, escalation paths, backup integrity, dependency mapping, and improvement actions.

The current ISC2 exam outline includes Security Operations and Incident Response with 17.3% objective weight. This foundational cybersecurity scenario checks whether the candidate can apply the domain to operating decisions and evidence.

Research and the private brief are optional. A request permits Learnerside to reply; provider sharing requires separate consent naming the recipient.

Certification details change. Always confirm final pricing, availability, and credential terms on the official provider page linked in the sources below before you pay for anything.

Requirements-first training match

Ask about CC - Certified in Cybersecurity training

Start with this course or credential and ask Learnerside for help. Experience, dates, delivery, budget and a planning brief are optional. You can also explore sourced class references without sending a request. No provider receives personal information unless Learnerside names the intended recipient and you approve sharing it.

Ask about training options →

The form keeps your answers on the page until you choose to submit a protected request toLearnerside. Nothing is sent until you submit the form. A request does not book training or share your details with a provider.

Quick Verdict

Choose ISC2 Certified in Cybersecurity (CC) when you are new to cybersecurity and want a no-work-experience-required checkpoint across security principles, governance, identity and access management, networking and cloud security, operations, and incident-response concepts. It is a foundation decision, not a shortcut into a security job: pair it with basic IT and networking practice and evidence you can explain.

Current exam outline effective September 1, 2026 - Use the current five-domain outline: Security Principles 24%, Security Governance 17.3%, Identity and Access Management Concepts 20%, Networking and Cloud Security Concepts 21.3%, and Security Operations and Incident Response 17.3%.

Source: ISC2 CC exam outline.

Take it when

  • You want a structured first cybersecurity checkpoint and do not yet have professional security experience.
  • You need to test whether security concepts and defensive operating decisions hold your interest before attempting a broader credential.
  • You will use official preparation and small defensive exercises to expose prerequisite gaps instead of treating the exam as the finish line.

Build foundations alongside it when

  • IP addressing, DNS, TCP and UDP, authentication, permissions, logs, and backups are not yet concepts you can explain with a simple example.
  • You need small operating-system, network, identity, and log exercises to turn the exam vocabulary into evidence you can explain.
  • You expect an entry credential by itself to substitute for IT practice, projects, or role-specific evidence.

Compare before deciding

Next action

Ask about entry-level security training, or build a private comparison brief. Both are optional; research and exercises are not prerequisites for help.

Optional original fictional work: a small invented office reports suspicious sign-ins. On paper, distinguish observation from assumption, identify access and log evidence you would request, propose one reversible defensive action and name escalation ownership. Use invented details; no account, real logs, attacker simulation or spending is required. This is a Learnerside exercise, not an official item or readiness score.

Overview

FieldValue
VendorISC2
Exam code(s)CC
LevelEntry
Trackcybersecurity

What is on the exam

These September 1, 2026 domain labels and rounded weights come from the current English outline. The shares total 99.9%; ISC2 prints 100%. The plain-language prompts below are Learnerside orientations, not taught course coverage or exam questions.

Official domainWeightPlain-English readSource
Security Principles24%Explain confidentiality, integrity and availability, risk and controls.Official study guide CC
Security Governance17.3%Compare governance policies, continuity and security-awareness responsibilities.Official study guide CC
Identity and Access Management (IAM) Concepts20%Explain identity lifecycle and least-privilege access decisions.Official study guide CC
Networking and Cloud Security Concepts21.3%Recognize network architecture, cloud models and security boundaries.Official study guide CC
Security Operations and Incident Response17.3%Separate observations from assumptions in operations and incident response.Official study guide CC
  • Study-guide source: https://www.isc2.org/certifications/cc/cc-certification-exam-outline (retrieved 2026-09-07T00:00:00+00:00)

What the vendor asks for

  • Experience stage: Entry - the vendor asks for no prior experience
  • What we found on the vendor eligibility page: No prerequisite stated. (source: https://www.isc2.org/certifications/cc; checked 2026-08-23)
  • The vendor publishes this in its Entry tier. That is the vendor's own label for its product range, not a Learnerside ranking.
  • Note: this is what the vendor states about experience, quoted and dated. It is not a pass rate (we have not found one published), not a ranking, and not a prediction about you.

Cost

ItemAmountSourceAs of
Exam purchase$199https://www.isc2.org/register-for-exam/isc2-exam-pricing2026-08-23
Exam + listed renewal fees (3-year illustration)$349https://www.isc2.org/register-for-exam/isc2-exam-pricing; https://www.isc2.org/policies-procedures/member-policies2026-08-23

The historical USD 349 illustration is one USD 199 exam plus three USD 50 annual maintenance payments for a CC-only member. It excludes training, taxes, retakes, extensions and learner time; unknown tuition is not zero. Current October 9 references appear above. CC-only maintenance is USD 50 at cycle start and annual anniversaries; other ISC2 memberships differ. Forty-five Group A CPE credits are required over three years; fifteen annually is suggested. Passing the exam, application approval and the first maintenance payment are separate steps before certification.

Eligibility

FieldValueSource
Recommended experienceNo prerequisite stated.https://www.isc2.org/certifications/cc (checked 2026-08-23)

Related roles

RoleRelationshipRoute
Cybersecurity AnalystFoundation fit/roles/cybersecurity-analyst
IT Security Operations SpecialistFoundation fit/roles/it-security-operations-specialist

Official OEM resources

Official exam guides, study guides, blueprints, and candidate handbooks (links to the vendor's own pages; PDFs are linked, never republished).

ResourceTypeSource
CC Exam Outline PDF - CC - EnglishOfficial Exam Outline PDF (PDF)Official link (retrieved 2026-06-08T23:30:50+00:00)
CC Exam Outline PDF - CC - EnglishOfficial Exam Outline PDF (PDF)Official link (retrieved 2026-06-08T23:30:50+00:00)
CC Exam OutlineCandidate guideOfficial link (retrieved 2026-06-08T23:30:50+00:00)
Official study guide (HTML/PDF)Official study guideOfficial link (retrieved 2026-06-08T23:30:50+00:00)
Your Cybersecurity Career Blueprint [Free eBook] Download NowCandidate guideOfficial link (retrieved 2026-06-08T23:30:50+00:00)

These pages draw on the same sourced data, and are the closest to what you just read.

Go deeper on this

total cost over three yearsThe real cost of CC - Certified in Cybersecurity: exam, training, and renewaleligibility & prerequisitesCan you earn CC - Certified in Cybersecurity? Eligibility and prerequisitesfree official studyHow to study for CC - Certified in Cybersecurity with the best free resources

Roles & paths this connects to

cert comparisonGoogle Cybersecurity Certificate vs ISC2 CCcert comparisonEC-Council CCT vs ISC2 CCcert comparisonISACA Cybersecurity Fundamentals vs ISC2 CC

Zoom out

career-track roadmapCybersecurity certification roadmap (cross-vendor)belongs to vendorISC2 Certifications

Ready to turn this decision into a plan?

Compare certification options for my goal.