CC (Certified in Cybersecurity): ISC2 Requirements, Exam, Cost, and Professional Value

1. What Is CC?

CC stands for Certified in Cybersecurity, an entry-level professional certification awarded by ISC2. It recognizes foundational cybersecurity knowledge for people entering the field, including career changers, students, recent graduates, and IT professionals moving toward security responsibilities. It is an individual certification, not a course-completion certificate or government-issued professional license.

Candidates do not need prior cybersecurity employment. They earn the credential by passing the CC examination, completing ISC2’s certification application and ethics commitments, and paying the applicable annual maintenance fee. Passing the examination alone does not complete certification.

For an employer or client, the useful interpretation is narrow: a current CC holder has met a standardized foundational knowledge requirement. The credential does not establish that the person has configured production systems, investigated a live breach, led a security program, or delivered a consulting engagement. Those capabilities require separate evidence.

2. CC at a Glance

• Full name: Certified in Cybersecurity.
• Abbreviation: CC.
• Credential type: Individual professional certification.
• Awarding organization: ISC2.
• Official website: ISC2 Certified in Cybersecurity.
• First introduced: August 2022.
• Current status: Active; the current examination outline took effect September 1, 2026.
• Professional focus: Security principles, governance, identity and access management, networking and cloud security, security operations, and incident response.
• Intended career stage: Entry-level or transition into cybersecurity.
• Geographic scope: International, subject to testing availability.
• Main eligibility requirement: No work-experience or degree prerequisite; ISC2 examination and background rules apply.
• Assessment: One adaptive examination, 100–125 questions, with two hours allowed.
• Indicative initial cost: US$249 for a standard first-attempt U.S. route, including the US$199 examination and first US$50 maintenance fee, before taxes and optional preparation.
• Maintenance: 45 qualifying continuing-education credits per three-year cycle and annual fees.
• Verification: ISC2’s verification service, using the holder’s surname and ISC2 identification number.

3. Who Awards and Oversees the Credential?

ISC2 is the certification owner. Its examination-development process uses practitioner input, job-task analysis, question development, review, and standard setting. ISC2 controls the certification requirements; Pearson administers the examination through authorized testing centers. A training provider can help prepare candidates but cannot independently award CC.

The CC certification program is accredited by the ANSI National Accreditation Board, or ANAB, against ISO/IEC 17024, the standard for organizations certifying people. This concerns the certification program’s processes. It does not mean that a holder’s employer, consulting firm, or security systems are accredited.

ISC2 also administers membership requirements, certification-mark rules, complaints, and disciplinary procedures. Its Code of Ethics requires professional conduct, and knowing violations can lead to peer review and revocation. An ethics commitment is an ongoing obligation, not proof that misconduct can never occur.

4. When and Why Was It Created?

CC was designed to give newcomers a credential that did not depend on years of prior cybersecurity employment. ISC2’s development announcement explicitly addressed students, career changers, and entrants without substantial IT experience. That origin explains why CC assesses a foundation rather than certifying an established professional track record.

• 2021–2022: ISC2 announced plans for an entry-level certification pilot on October 15, 2021. CC subsequently launched in August 2022. The development announcement and operational launch were separate events.
• April 2023: ISC2 announced ANAB accreditation for CC.
• October 1, 2025: CC transitioned to computerized adaptive testing. This changed examination delivery rather than creating an experience requirement.
• September 1, 2026: The first major content-outline revision took effect, increasing attention to governance, identity lifecycle management, cloud security, and incident response.

The credential remains entry-level despite these additions. Broader topic coverage should not be interpreted as a change to an advanced-practitioner qualification.

5. Who Pursues CC, and Where Is It Used?

ISC2’s stated audience includes IT professionals, career changers, university students, and recent graduates. Those categories describe intended candidates, not a promise that every holder is ready for every junior security position.

Based on its assessed topics, CC is most relevant when evaluating foundational understanding for supervised security-support work. Illustrative assignments include documenting access-review findings, organizing control evidence, maintaining security-awareness materials, and supporting established incident-reporting procedures. The inference is about alignment between the syllabus and the assignment, not proof of previous delivery.

Industry context changes the evidence an employer should request. For example, a healthcare assignment might require familiarity with clinical workflows; a financial-services assignment might involve sensitive customer records; manufacturing work might involve operational systems with different availability constraints. CC alone should not be used to infer those sector-specific capabilities.

On consulting teams, it can be a secondary signal when staffing evidence collection and reporting support within security governance and reporting. The person designing the governance model or advising executives should also demonstrate relevant delivery experience.

CC is not a general legal prerequisite for cybersecurity employment. Where an employer, contract, or government workforce framework requests a credential, evaluate the actual role-specific requirement rather than treating the letters as universal authorization. The U.S. defense qualification framework, for example, distinguishes foundational qualifications from additional role requirements.

6. What Knowledge and Skills Does It Cover?

The outline effective September 1, 2026 organizes CC into five domains. ISC2 publishes the following rounded examination weights:

• Security Principles, 24%: Confidentiality, integrity, availability, risk, controls, governance concepts, and ethics. These support explaining why a control is needed and what it protects.
• Security Governance, 17.3%: Governance, risk and compliance, continuity, recovery, awareness, and security metrics. These support connecting security activities to organizational responsibilities.
• Identity and Access Management Concepts, 20%: Identity lifecycle management, access models, least privilege, and separation of duties. These support understanding appropriate access and its removal.
• Networking and Cloud Security Concepts, 21.3%: Network fundamentals, segmentation, zero trust, and cloud models. These support basic reasoning about connectivity and shared responsibilities.
• Security Operations and Incident Response, 17.3%: Data protection, monitoring, triage, threats, response, asset protection, and testing concepts. These support recognizing issues and following established processes.

ISC2’s accompanying AI guidance incorporates foundational considerations such as protecting AI-related data, managing automated identities, recognizing AI-assisted threats, and understanding cloud responsibilities. This is security literacy concerning AI, not a machine-learning engineering qualification.

Applied capabilities

Illustrative exercises connected to these topics include:

• Reviewing an employee-transfer scenario and identifying access that should be removed or reassessed.
• Explaining which security responsibilities remain with a customer using a cloud service.
• Drafting an incident-escalation note that separates observations, assumptions, business impact, and required decisions.

These are useful ways to test whether a candidate can apply the concepts. They are not work products that every CC holder must have completed to earn the credential.

Boundaries

Do not infer proficiency in penetration testing, forensic acquisition, firewall administration, cloud configuration, or security-tool programming from topic coverage. Ask for demonstrations or prior work evidence when those capabilities are material to the assignment.

7. What Are the Eligibility Requirements?

Education and experience: CC does not require a degree, educational diploma, prior certification, or cybersecurity work experience. Consequently, applicants do not need employment references documenting years of qualifying practice. ISC2’s degree-for-experience substitutions for other credentials are not necessary for CC.

Training: Completing an ISC2 course is not mandatory before taking the examination. Candidates may prepare independently. A course-completion record, however, is not equivalent to passing the certification examination or receiving CC.

Age and identification: Candidates must be at least 16. Those aged 16 or 17 must follow ISC2’s minor-candidate procedures, including having a parent or guardian accompany them to the testing center. Identification requirements differ for minors and adults.

Background and ethics: ISC2 asks about specified criminal matters, involvement in criminal computer activity, and previous professional disciplinary action. A relevant disclosure can affect eligibility but should not automatically be interpreted as permanent exclusion. Candidates with concerns should obtain ISC2’s eligibility assessment before paying for an examination. This is distinct from claiming that every applicant undergoes an identical third-party background investigation.

Membership: Participation in the ISC2 Candidate program is not generally required to register for a paid examination. Certification itself requires the post-examination application and fee steps. CC applicants do not need another certified professional to endorse their work experience.

8. How Do You Earn CC?

Step 1: Register and schedule

Create an ISC2 account, complete the examination-registration process, and schedule an authorized Pearson testing-center appointment. Ensure the registered name matches the identification you will present. Review identification and accommodation requirements before booking, not on examination day.

Step 2: Take the examination

CC uses computerized adaptive testing. Candidates answer 100–125 multiple-choice and advanced-format items within two hours. The examination is available in English, Simplified Chinese, Japanese, German, and Spanish; Chinese-language appointments use specified availability windows. It is a closed-book, in-person examination, not an online course assessment.

Adaptive testing adjusts question selection to the candidate’s performance. Questions must be answered in sequence, without returning to earlier items. ISC2 publishes a passing standard of 700 on a 1,000-point scale; candidates should not interpret that as a requirement to answer exactly 70% of questions correctly. The assessment does not include an observed workplace assignment or production-system implementation.

Step 3: Receive the result

Candidates normally receive a provisional result at the testing center, followed by ISC2’s official notification. ISC2 does not provide numerical scores. Unsuccessful candidates receive domain-level proficiency information to help identify weaknesses. Results remain subject to examination-security review.

Step 4: Complete the certification application

After official confirmation of passing, complete the application within nine months of the examination date. For CC, this includes the relevant declarations and agreement to the Code of Ethics, rather than an experience endorsement. Missing the application deadline can mean having to retake the examination.

Step 5: Activate the credential

After application approval, a first-time CC-only member pays the US$50 annual maintenance fee. Completing the award process, not merely passing, establishes certification status. CC holders receive digital certification documentation.

Retakes: ISC2 requires 30 test-free days after the first attempt, 60 after the second, and 90 after the third and subsequent attempts. A candidate may attempt the same certification examination no more than four times in a 12-month period.

9. How Long Does It Take, and How Do Candidates Prepare?

Prerequisite-building time: There is no mandatory period of employment or degree study before CC. That removes an admission barrier, but it does not mean everyone starts with the same preparation needs.

Preparation time: Plan around demonstrated understanding rather than a universal study-hour target. Someone familiar with networks and account administration may need a different plan from someone encountering those concepts for the first time.

Official resources: ISC2 provides the examination outline, online self-paced training, instructor-led options, flash cards, and study guidance. Candidates taking the current examination should check that their materials address the September 2026 outline rather than relying only on older domain descriptions.

Preparation choices: Combine terminology review with scenario explanations. Practise describing why one control is appropriate, what information is missing, and when escalation is necessary.

Administrative time: Allow separately for appointment availability, result confirmation, application processing, and payment. Do not promise an employer a completed credential solely on the basis of a scheduled examination date.

10. How Much Does CC Cost?

As of September 25, 2026, the standard U.S. examination price is US$199. A new member holding only CC pays a first annual maintenance fee of US$50. The illustrative first-attempt total is therefore US$249, excluding taxes, travel, preparation, and any appointment-change fees. Regional pricing and currencies vary.

Optional preparation: Paid courses and examination bundles are additional choices, not mandatory eligibility costs. Compare the contents of a bundle before adding an examination fee separately. Optional Candidate-program participation can also involve dues; it is not necessary for the ordinary paid-examination route.

Retakes and appointment changes: A separately purchased standard retake normally costs another examination fee. Ordinary paid bookings carry a US$50 rescheduling charge or US$100 cancellation charge, subject to the applicable timing rules. Special program or bundle terms can differ.

Previously issued free-examination codes: The One Million Certified in Cybersecurity program closed new enrollment on May 20, 2026. Eligible participants with unexpired codes may still take their examination by December 31, 2026. This does not waive certification maintenance fees.

Ongoing budget: At unchanged prices, the standard examination plus three US$50 annual fees totals US$349 across the first three-year cycle, before optional expenses. Members holding other ISC2 certifications fall under the applicable combined membership-fee structure instead.

11. How Do Holders Maintain CC?

CC operates on a three-year certification cycle. Holders must earn and submit 45 Group A continuing professional education credits, meaning development relevant to the credential’s domains. ISC2 recommends 15 annually as a manageable pace; the requirement is the three-year total, not a separate annual minimum.

Relevant courses, webinars, professional events, and other qualifying activities can support continuing development. Holders should record activities accurately and retain supporting evidence. General professional development should not automatically be assumed to qualify as domain-related learning.

CC-only members also pay US$50 annually. Paying fees does not replace education obligations, and completing education does not replace fees. Continued adherence to ISC2’s ethical requirements is a separate obligation.

ISC2 provides a 90-day grace period for outstanding maintenance requirements. Failure to resolve deficiencies leads to suspension. A suspended holder must not represent the credential as current. Reinstatement requires addressing outstanding credits and fees; after two consecutive years of suspension, termination can require passing the examination again.

For hiring purposes, therefore, “earned CC in 2023” and “currently holds CC in good standing” are different statements. Verify the latter when current certification is relevant.

12. What Is Its Professional Value, and What Are Its Limitations?

CC’s practical value is as a structured starting point and a common knowledge baseline. For a newcomer, preparing for it can organize otherwise fragmented learning. For an employer, it can justify moving a candidate to an applied assessment, but should not replace that assessment.

There is documented institutional recognition. ISC2 lists CC as approved under the U.S. defense workforce qualification framework. Actual qualification depends on the position’s work role, proficiency level, and additional requirements. Acceptance as a foundational option is not a blanket finding that the holder qualifies for every defense cybersecurity job.

ISC2 reports that more than 65,000 participants earned CC through its One Million program. That is a program outcome, not a count of all currently active holders. Likewise, more than one million enrollments should not be described as one million certifications awarded.

The strongest professional interpretation is relative to career stage. CC may add useful evidence for someone seeking a first security-support assignment. It contributes much less to evaluating an experienced consultant’s ability to lead a remediation program, assess a complex acquisition, or advise a board.

Compensation and staffing decisions should remain tied to role scope, relevant experience, and demonstrated performance. Do not assign a fixed salary premium to the letters or assume that obtaining them guarantees employment.

13. What Should Employers and Clients Infer From It?

What the credential establishes

A current holder has passed ISC2’s foundational examination and completed the certification process, with continuing maintenance and ethical obligations. CC does not establish a minimum period of professional employment, because no such experience is required.

What still needs evaluation

Assess practical execution, industry knowledge, system-specific skills, communication, judgment, and ability to work within authorization boundaries. A candidate should distinguish personally completed work from team outcomes, and lab exercises from production responsibilities.

For example, CC may be relevant when staffing documentation and exercise-support tasks within incident response readiness. It should not, by itself, determine who leads forensic investigations, authorizes containment, or makes business-critical recovery decisions.

Evidence to request

Request nonconfidential examples such as an anonymized access-review worksheet, a synthetic incident-triage note, or a simple control-to-risk mapping. Ask the candidate to explain assumptions, escalation points, and their own contribution. Do not request customer secrets or protected examination content.

Three questions assessing applied competence

1. An employee changes departments but retains the old role’s access. How would you assess and resolve the issue? A useful answer addresses role requirements, least privilege, approvals, access removal, and evidence that the change was completed.
2. A business unit says its cloud provider handles all security. What would you clarify? A useful answer distinguishes provider and customer responsibilities, identifies the service model, and considers identities, data, configuration, and monitoring.
3. An alert suggests a compromised account on a business-critical system. What would you check and escalate before recommending action? A useful answer separates evidence from assumptions, considers severity and business impact, preserves relevant information, and follows authorized response procedures.

These are illustrative hiring questions, not examination items. An individual’s CC also provides no separate certification or authorization for the firm employing them.

14. How Does CC Compare With Related Credentials?

• Cisco Certified Support Technician Cybersecurity: An entry-level alternative covering security principles, network and endpoint security, vulnerability assessment, risk, and incident handling. Cisco requires an examination but no formal prerequisites. It is particularly relevant when comparing foundational paths oriented toward technical support and security operations.
• ISC2 Systems Security Certified Practitioner, or SSCP: A possible later step for operational security work. Unlike CC, SSCP normally requires one year of qualifying experience, although eligible education can satisfy that requirement. Passing its examination without meeting the experience rules can lead to Associate of ISC2 status rather than immediate SSCP certification.
• ISC2 Certified Information Systems Security Professional, or CISSP: A later-career credential with broader coverage of security management, architecture, engineering, and operations. It normally requires five years of experience across at least two domains, with a maximum one-year qualifying waiver. Its examination and experience requirements are separate from CC.

CC is not an automatic first stage that converts into another credential. Choose among these paths according to the intended work and the evidence required: initial knowledge, operational experience, or broader professional responsibility. Do not treat international availability as proof that employers will consider the credentials interchangeable.

15. How Can You Verify CC and Use Its Letters Correctly?

Use ISC2’s official certification-verification service. Ask the individual for their surname as recorded by ISC2 and their ISC2 identification number. The service is intended for employers and the public to confirm status. Digital certification documentation can also show the credential type, award date, and expiration date.

Check that the record concerns Certified in Cybersecurity, matches the individual, and supports the claimed current status. A course-completion document or examination result is not a substitute for certification verification. An old certificate image should be supplemented by a current check.

If the search returns no match, first confirm spelling and the identification number, then ask the holder to resolve the discrepancy with ISC2. Treat an unresolved claim as unverified rather than immediately concluding that it is fraudulent. ISC2 can confirm certification when supplied with sufficient identifying information.

ISC2’s rules permit certification marks in conjunction with the certified individual’s name, using capital letters without periods. An example is Jordan Lee, CC®. The mark must not imply certification of a company or product, and use must stop when certification is not maintained. Candidates and people awaiting the final award should not present themselves as CC-certified.

16. Frequently Asked Questions

Can I earn CC without a degree or IT job?

Yes. Neither a degree nor prior cybersecurity employment is required. You must still pass the examination and satisfy the application requirements. Lack of prerequisites means access to the credential, not exemption from learning the assessed material.

Is the CC examination still free?

Not as a generally available offer to new One Million program participants. Enrollment closed May 20, 2026. Previously issued, unexpired codes can still be used for examinations taken by December 31, 2026. Maintenance fees remain separate.

Can I take the CC examination from home?

No. The examination is available in person at authorized Pearson testing centers. Online preparation does not mean online examination delivery. Check appointment availability, travel needs, and identification requirements before committing to a planned completion date.

Does earning CC make me an Associate of ISC2?

No. CC is a full certification with no employment-experience requirement. Associate of ISC2 is a different status used by people who pass certain other ISC2 examinations while working toward the experience required for those certifications.

Must I retake the examination every three years?

Routine maintenance uses continuing education and annual fees rather than a scheduled re-examination. CC requires 45 qualifying credits per three-year cycle. Examination-based reinstatement can become necessary following termination, so maintaining good standing matters.

17. Official Resources and Recent Changes

Official resources available: ISC2 provides the CC examination outline, preparation resources, examination policies, certification-application guidance, background qualifications, ethics rules, maintenance guidance, and verification tools. Use the outline’s effective date to match preparation to the examination being taken.

Material changes: Adaptive testing began October 1, 2025. The revised content outline took effect September 1, 2026. Separately, new enrollment in the free One Million program ended May 20, 2026; December 31, 2026 remains the examination deadline for eligible unexpired codes. The promotional program’s closure did not retire CC.

This profile is an independent Umbrex reference and is not issued or endorsed by the credential owner unless an explicit relationship is stated.