ISC2 Certified in Cybersecurity (CC)

What it is

Certified in Cybersecurity (CC) is ISC2's foundational certification. ISC2 is the organisation behind the well known CISSP, and CC is designed as the first step for people with no work experience in the field. It tests understanding of concepts rather than tools: why security controls exist, how access control works, how networks are protected, and what happens during an incident.

Is the free exam still available?

Not for new learners. From August 2022 ISC2 ran the "One Million Certified in Cybersecurity" programme, which gave a free online course and a free exam. ISC2's official announcement says the programme stopped accepting new participants on May 20, 2026, after more than one million people enrolled and more than 65,000 earned the CC. People who already received a free exam code that has not expired must schedule and sit the exam by December 31, 2026.

As of 2026-09, the programme page says CC now costs US $199 for the exam, plus a $50 annual membership fee once you pass. Check the official page for current terms, since prices and offers change.

The exam

Per ISC2's exam outline effective September 1, 2026, the exam lasts 2 hours, has 100 to 125 items using computerised adaptive testing, and needs 700 out of 1,000 to pass. It covers five domains: Security Principles (24%), Identity and Access Management (IAM) Concepts (20%), Networking and Cloud Security Concepts (21.3%), Security Governance (17.3%), and Security Operations and Incident Response (17.3%).

Prerequisites and time needed

No work experience is required. A student with basic IT knowledge can usually prepare in a few weeks of steady study using ISC2's official outline, with the course optional.

CC or Security+?

Both are entry level. CompTIA Security+ is broader and more widely requested in job listings, while CC is shorter, more conceptual and a gentler first exam. If money is tight, choose the one that appears more often in job listings in your target country, and remember that neither replaces hands-on practice.

What you can do afterwards

CC shows an employer you have taken the fundamentals seriously. It is most useful alongside evidence of practice: lab write-ups from LetsDefend or TryHackMe, a home Wazuh setup, or a small security project on GitHub. For the next certificate, CompTIA CySA+ suits defensive work.

Common questions

I got a free exam code before May 2026. Can I still use it? Yes, if it has not expired, but you must sit the exam by December 31, 2026.

Is there an annual fee? Yes, ISC2 lists a $50 annual membership fee after you pass, and continuing education is needed to keep the certification active.

Is it respected? It is a genuine ISC2 certification, but it is entry level. Treat it as a foundation, not a job guarantee.