The ISC2 Certified in Cybersecurity (CC) is the entry-level credential you can sit with zero industry experience, and prep for it changed on a specific date: ISC2 rebuilt the outline effective September 1, 2026, making it the first major content update since the credential launched in August 2022. The current exam delivers 100 to 125 items in a 2-hour adaptive session and requires 700 out of 1000 points to pass. Anyone studying from a pre-2026 book, course or flashcard deck is drilling the wrong domain weights, so this ISC2 CC prep guide maps the new structure and builds a study plan around it.
What Changed on September 1
The five-domain frame survived; the names and weights did not. The old Business Continuity and Disaster Recovery domain is gone, replaced by a dedicated Security Governance domain. In the current outline Security Principles weighs 24%, Security Governance 17.3%, Identity and Access Management Concepts 20%, Networking and Cloud Security Concepts 21.3%, and Security Operations and Incident Response 17.3%. Incident response moved into Domain 5, cloud security and zero trust now sit inside Domain 4, and ISC2 wove foundational AI topics through every domain, from model poisoning as a data-integrity risk to managing AI service accounts inside the identity lifecycle.
| Domain (2026 outline) | Weight | What to watch for |
|---|---|---|
| 1. Security Principles | 24% | CIA triad, AAA, risk lifecycle, ethics, due care |
| 2. Security Governance | 17.3% | GRC planning, KRIs, dashboards, security awareness |
| 3. IAM Concepts | 20% | Identity lifecycle, least privilege, separation of duties |
| 4. Networking and Cloud Security | 21.3% | OSI/TCP-IP, firewalls, segmentation, zero trust, shared responsibility |
| 5. Security Operations and IR | 17.3% | Triage, threat intel, IR exercises, testing types |
Read the table as a budget statement. The heaviest single domain is still Security Principles at 24%, but the combined shift means 37.3% of the exam now tests governance and identity together — the human-and-policy side of security — while networking plus cloud accounts for 21.3%. A prep plan that spends most of its time on subnetting and ports is misaligned with what ISC2 now rewards.
How the Adaptive Exam Works
The CC runs on Computerized Adaptive Testing (CAT) in every available language — English, Chinese, Japanese, German and Spanish — which is why the item count lands between 100 and 125 rather than at a fixed number. An adaptive engine selects each next question based on how you performed on the previous ones, so the test homes in on your ability level instead of walking every candidate through an identical list. Two practical consequences follow. First, your session can end anywhere in the 100-to-125 range, so never budget your time around a fixed question count. Second, scoring is not a raw percentage: 700 is a scaled score on a 1000-point scale, so counting missed questions afterward tells you little. The exam is delivered at a Pearson VUE test center, which makes timed practice runs under a hard 2-hour clock part of prep rather than an afterthought.
A Six-Week Study Plan
Weight the calendar the way ISC2 weights the exam. At roughly ten hours per week, this six-week cycle covers every domain with time left for weak-spot repair:
- Weeks 1–2 — Security Principles (24%). Master the CIA triad, AAA, non-repudiation and the risk management lifecycle. These concepts resurface inside every other domain, so front-load them.
- Week 3 — Security Governance (17.3%). Study GRC frameworks and tools, KRIs and dashboards, business continuity and disaster recovery as redundancy concepts, and security awareness culture.
- Week 4 — IAM Concepts (20%). Cover the identity lifecycle from provisioning to deprovisioning, least privilege, separation of duties and access control models.
- Week 5 — Networking and Cloud (21.3%). Work through the OSI and TCP/IP models, firewalls and ports, VLANs and micro-segmentation, zero trust, and the cloud shared-responsibility model.
- Week 6 — Security Operations and IR (17.3%), then full review. Triage and prioritization, threat actors and frameworks, IR exercises, data masking and encryption — closing with two timed mixed reviews.
Anchor every week to the official exam outline rather than third-party summaries; when a topic list and the vendor document disagree, the vendor document wins.
Who Should Sit the CC
No work experience, no degree and no prerequisites stand between you and the CC exam seat — ISC2 recommends only basic IT knowledge. That makes the CC a rare fit for three profiles at once: students and recent graduates, IT professionals pivoting into security, and career changers with no direct IT background. The credential is ANAB-accredited under ISO/IEC Standard 17024 and approved under the U.S. Department of Defense manual 8140.03, which matters if public-sector work is on your map. If you already hold a mid-level security certification, the CC adds little; if you are choosing a first credential, pair it with hands-on practice — our guide to penetration testing without a degree explains why skills plus an entry cert is the cheapest credible entry combo. Once you pass, the step-up question becomes real, and our breakdown of how hard the AWS Security Specialty exam is shows what a specialist follow-up demands.
Before You Book
Registration is a straight line through two vendor accounts, and the small details are where candidates lose money:
- Create an ISC2 account and purchase the exam, or a self-paced training plus exam bundle, from the certification menu.
- Fill in the ISC2 Exam Account Information form exactly as your ID reads — a mismatch can void the appointment with no refund.
- Complete scheduling on the Pearson VUE site. A standard exam purchase gives you 365 days to sit the test, while Peace of Mind bundles include two attempts within 180 days.
- Finish prep by checking yourself against the official outline, not a recycled 2025 syllabus.
Since June 2026, Pearson test centers also run enhanced security screening with infrared and metal-detection wands, so arrive early and leave every electronic device at home. The CC is not a hard exam by design — it is a current-events exam: pass it by studying the outline that took effect September 1, 2026, and nothing older.