ISC2 Certified in Cybersecurity (CC): Official Exam Format and Cost Now That the Free Program Has Ended

What This Certification Actually Certifies

CC is ISC2's entry-level credential, and ISC2 designed it to validate that a candidate understands the foundational concepts a junior security professional uses on the job — genuinely foundational, not a scaled-down version of CISSP. It's worth being direct about this distinction because it's a common misconception: treating CC prep like a "mini CISSP" is a documented way candidates trip themselves up, since the exam is built around breadth of foundational concepts across five domains rather than the deep, experience-tested judgment CISSP demands. 

The single most distinctive fact about CC within ISC2's certification family: it's the only major ISC2 certification without a work-experience prerequisite. CISSP and SSCP both require candidates to have relevant professional experience — passing the exam without it earns you "Associate of ISC2" status while you accumulate the required years. CC has no such requirement at all, so passing takes you straight to full certified status upon completing the endorsement process, with no waiting period tied to experience.

Who This Exam Is For (and Who It's Not For)

ISC2 built CC specifically for people entering cybersecurity for the first time — career changers, students, and IT staff moving into security roles from adjacent positions like help desk or general IT support. It's genuinely accessible: no prior work experience, no prerequisite certification, and no formal education requirement stand between a candidate and registration.

It's a weaker fit for someone who already has meaningful hands-on security experience and is looking for a credential that reflects that background — CC's breadth-over-depth design means experienced practitioners often find it too foundational to meaningfully differentiate them, and a credential like Security+ or, further along, CISSP or SSCP would better match that level of experience. It's also worth being clear-eyed that "entry-level" doesn't mean "easy" — the exam tests genuine conceptual understanding across five domains rather than memorized isolated facts, and breadth across unfamiliar territory (rather than depth in any one area) is what commonly trips up underprepared candidates.

Exam Format and Structure

The exam runs 2 hours with 100 to 125 questions, delivered through Computerized Adaptive Testing (CAT) — a format where the difficulty and selection of subsequent questions adjusts based on your performance on earlier ones, rather than presenting every candidate with an identical fixed question set. This CAT delivery model is the same general approach ISC2 uses for CISSP, so if you're familiar with how that exam adapts in real time, CC works on similar underlying logic, just at a foundational difficulty level and with a shorter overall exam.

Because it's adaptive, the exact number of questions you see can vary somewhat between candidates depending on how the algorithm calibrates your demonstrated competency — this is a structural difference from a fixed-length exam and means two candidates' experiences of the same exam can differ meaningfully in length even when both pass.

Domains and Topics Covered

ISC2's official domain weighting for CC breaks down as follows:

Security Principles is both the largest single domain and, by most accounts, the conceptual foundation the rest of the exam builds on — it's where core ideas like the CIA triad (Confidentiality, Integrity, Availability) live, along with matching specific controls to the property they protect (encryption protects confidentiality, hashing protects integrity, redundancy protects availability, and so on). Prep guidance consistently suggests that if a candidate can only deeply prepare one domain, this is the one to prioritize, both for its weight and because its concepts recur throughout the other four domains rather than staying isolated.

Expect genuine vocabulary depth and scenario-matching questions specifically — several answer options that all sound reasonable, with only one being the best fit for the specific scenario described, rather than one obviously correct answer among clearly wrong distractors.

Cost Breakdown

This is the section of this page most affected by a very recent, genuinely significant change. From its 2022 launch, ISC2 ran the One Million Certified in Cybersecurity (1MCC) program, giving away free official training and a free exam voucher to over a million people specifically to grow the cybersecurity workforce pipeline. ISC2 announced that public enrollment in this program ended on May 20, 2026, with candidates who already held unexpired exam codes able to schedule and test through December 31, 2026.

For anyone registering today, CC is a standard paid exam like any other in ISC2's catalog: $199 USD in major markets. Once certified, there's also a $50 Annual Maintenance Fee (AMF) for members who hold only the CC credential, with a 90-day grace period from the AMF due date to submit payment before risking the certification's standing. If you encountered marketing describing CC as a free certification, that reflects the now-closed 1MCC era rather than the current registration path.

Prerequisites and Eligibility

None — genuinely none. CC requires no prior work experience, no prerequisite certification, and no specific educational background. This is a deliberate design choice distinguishing it from every other major ISC2 credential, and it's part of why ISC2 built it specifically as an on-ramp into the field rather than a credential for people already established in security roles.

How the Exam Is Scored and What Passing Requires

You need a scaled score of 700 out of a possible 1,000 to pass. Because the exam is adaptive (CAT-delivered), this isn't simply "70% of questions correct" — the scoring accounts for question difficulty as calibrated by the adaptive algorithm, similar in principle to how CISSP's CAT-based scoring works, just calibrated to CC's foundational difficulty level.

Renewal and Recertification

CC operates on a 3-year renewal cycle. Beyond the initial exam, maintaining the credential requires paying the $50 Annual Maintenance Fee each year — a smaller, more frequent obligation than the lump-sum multi-year renewal fees some other certifications on this site use, functioning more like an ongoing membership cost than a periodic retake requirement.

One process detail worth knowing: after passing the exam, candidates have 9 months to complete ISC2's endorsement process — agreeing to the ISC2 Code of Ethics and submitting the required application — to finalize full certification status. Missing that window can complicate finalizing the credential, so it's worth treating the post-exam paperwork as a real deadline rather than an afterthought.

How This Exam Compares to Its Closest Alternative

The most frequent comparison candidates make is against CompTIA Security+, which occupies broadly similar territory as a foundational cybersecurity credential and has historically been the default recommendation for candidates entering the field. The practical distinctions: CC has no work-experience prerequisite and currently costs meaningfully less at $199 versus Security+'s roughly $392 exam fee, while Security+ has a longer track record in the hiring market and, according to some practitioners, slightly broader industry name recognition built up over many more years in circulation. Neither is objectively superior — CC's lower cost and zero-prerequisite structure make it a genuinely lower-barrier starting point, while Security+'s longer market presence means more hiring managers may already recognize it by name.

Within ISC2's own certification ladder, CC functions explicitly as the entry point beneath SSCP and CISSP — both of which require documented work experience that CC does not. Candidates commonly use CC as a first credential specifically to build toward those more advanced ISC2 certifications once they've accumulated the experience those require.

Realistic Preparation Timeline

Most new candidates should plan on 40 to 80 focused study hours — a genuinely shorter commitment than most certifications covered on this site, reflecting CC's foundational scope. Some prep resources market aggressive 15-day study plans, which is plausible for candidates with some existing IT or security-adjacent background, but 4 to 8 weeks at a more measured pace is a more commonly cited realistic range for someone building this foundational knowledge largely from scratch.

Given the exam's emphasis on breadth over depth, and its heavy reliance on scenario-matching questions where several options sound plausible, practicing with scenario-based questions specifically — rather than only reviewing definitions and vocabulary lists — is consistently cited as more effective preparation than pure memorization.