Certified in Cybersecurity (CC)

You're studying for an exam that just changed

If you're researching CC right now, timing matters more than usual. ISC2 refreshed the exam outline on September 1, 2026 — the first major content update since the certification launched in 2022 — and most study guides circulating online were written against the outline that just got retired. That's not a small footnote. The refresh renamed a domain, carved out an entirely new governance-focused domain, relocated incident response content, and threaded AI-related concepts through all five domains. If your practice material still lists "Access Controls Concepts" as a domain name, it's describing the exam as it existed before September 1, not the one you'll actually sit.

What changed, and why it matters for how you study

ISC2 renamed the former Access Controls Concepts domain to Identity and Access Management (IAM) Concepts. The core principles — least privilege, separation of duties — are still there, but the domain now explicitly covers identity lifecycle management, provisioning and deprovisioning processes, and IAM frameworks and tools, reflecting how much identity has become its own security perimeter rather than a subset of access control.

Governance and risk content, which used to be scattered across the older domain structure, now has its own dedicated domain worth 17.3% of the exam. That's a meaningful concentration of weight in one place, and it signals that ISC2 wants entry-level candidates to understand governance as a distinct discipline — policies, standards, risk treatment, and regulatory relationships — rather than as a side note tucked into a broader security principles domain.

Incident response also moved. It used to live as a standalone concept inside the domain that also covered business continuity and disaster recovery. It's now a major component of the domain covering security operations, which makes more practical sense — incident response is operational work, and grouping it there reflects how it's actually handled day to day.

Domain 1 kept its foundational role but modernized its vocabulary: "information assurance" is out, replaced by "cybersecurity concepts," and Authentication, Authorization, and Accounting (AAA) is now introduced as a core concept there rather than assumed knowledge from elsewhere.

Finally, and this is the change every candidate will notice regardless of which domain they're reviewing: foundational AI security concepts are now woven through all five domains rather than sitting in one place. You're expected to be able to identify AI assets, recognize automated threats, and understand what supporting secure AI governance looks like at an entry level — not as a specialist skill, but as baseline awareness.

Who Is This  CC  Exam Designed For?

CC has no experience requirement, and that's not a formality — it's the entire design philosophy. ISC2 built this specifically as a starting point for people with no prior IT or security background, which is a different posture than most of ISC2's other credentials, including its flagship CISSP. The CC candidate pool splits into two groups: career changers with zero cybersecurity background looking for a credible first credential, and people already in adjacent IT roles who want a formal cybersecurity foundation before moving toward SSCP or CISSP later. ISC2 explicitly positions CC as the entry point below SSCP, CCSP, CGRC, and CISSP in its certification ladder, and a meaningful share of CC holders do go on to pursue one of those next.

Worth knowing if you're comparing options: ISC2 ran a program called One Million Certified in Cybersecurity that gave away free training and exam vouchers to a million people worldwide. That program closed new enrollments on May 20, 2026 — if you already hold an unexpired voucher from it, you can still test through December 31, 2026. For everyone else, CC is now a standard paid exam like any other in ISC2's catalog.

CC Exam format details worth knowing before you sit

The official CC exam uses Computerized Adaptive Testing (CAT), which means the questions you see adjust in time based on how you're performing — two candidates sitting the same day won't see an identical test. You'll get 100 to 125 questions within a 2-hour window. The exam fee is $199 in major markets, plus a $50 annual maintenance fee once you're certified. ISC2 doesn't publish the exact numeric passing score to candidates, though industry sources commonly cite 700 out of 1000 on ISC2's scaled system — treat that figure as the widely reported standard rather than an ISC2-confirmed number, since ISC2 itself doesn't release it directly. You'll know within minutes of finishing whether you passed, which is standard for CAT-delivered exams.

Because the exam is adaptive, you can't rely on a strategy of blazing through easy questions to build confidence before harder ones — the system adjusts difficulty based on your answers as you go, so pacing yourself evenly across the full question range matters more than it would on a fixed-form exam.

How to use the free practice test effectively

Since the governance and risk domain now carries 17.3% of the exam as its own dedicated category, don't treat it as an extension of general security principles the way you might have under the old outline — give it deliberate, separate review time. Similarly, if your study material still calls the identity domain "Access Controls," update your mental model: questions here will likely test identity lifecycle and provisioning concepts that a narrower "access controls" framing wouldn't have prepared you for.

Run through practice questions domain by domain rather than as one mixed block, and pay attention to whether AI-related framing shows up in domains where you weren't expecting it — since AI concepts are threaded through all five rather than isolated, a question in the network security domain might reasonably touch on securing AI API endpoints, and a question in security operations might involve AI-assisted alert triage. Treat AI awareness as a lens applied across the whole exam, not a section to cram separately.

Common mistakes candidates make on this CC exam

The most timing-specific mistake right now is studying from material written for the pre-September-2026 outline without realizing it's been superseded. A lot of "how I passed CC" guides and prep courses online were built against the old five-domain structure with the old names and weights, and using them without adjustment means walking in with an outdated mental map of what's being tested.

Beyond the timing issue, a common mistake for CC specifically — because it's entry-level — is candidates assuming "entry-level" means "easy" and under-preparing on breadth. The exam covers five genuinely distinct areas, and the adaptive format means you can't lean heavily on strength in one domain to compensate for weakness in another the way you sometimes can on a fixed-form exam. Candidates with no networking background in particular tend to find the network security domain the hardest going in, since it assumes familiarity with concepts (OSI/TCP-IP basics, common ports, VLANs) that don't come up naturally if you haven't touched networking before Improve your exam preparation with CRISC practice test questions.

Study tips specific to this exam's current format

Confirm you're studying the post-September-2026 outline specifically — check the domain names against what's listed here (Identity and Access Management Concepts, not Access Controls Concepts; a dedicated governance and risk domain; incident response under security operations) before trusting any study guide's structure. If a guide still uses the old five-domain names and weights, it needs updating or replacing, not just supplementing.

Because AAA (Authentication, Authorization, Accounting) is now explicitly named as a Domain 1 concept, make sure you can define and distinguish all three terms cleanly — that kind of precise vocabulary distinction is exactly the sort of thing an entry-level exam tests directly rather than through complex scenarios. And because this is a genuinely new outline, don't be surprised if practice question banks online are still catching up to reflect it accurately — cross-check anything you're studying against ISC2's own published outline rather than assuming a third-party source has already updated fully.

Where to go from here

Work through the practice questions below with the current five-domain structure in mind — Cybersecurity Concepts, Identity and Access Management Concepts, Network Security, Security Operations (now including incident response), and the newly dedicated Governance and Risk domain — and pay attention to whether AI-related framing catches you off guard in domains you weren't expecting it in. That's the fastest way to tell whether your current study material has actually caught up to the exam you're about to take.