CC Certification Training — a 20-Hour ISC2 Course Built on the 2026 Exam Outline
From 1 September 2026 the CC exam runs on a new outline — renamed domains, a new governance domain, cloud and IAM added. Old study material prepares you for an exam that no longer exists. This course is built on the new one.
Already enrolled? Go to your dashboard.
Get Your Personalised CC Study Plan
Tell us your background and our team will map your 20 hours, your batch dates and the fee for your region.
Cybersecurity Awareness Month offer: use the codes below until 31 Oct
Entry-level does not mean easy. It means broad.
Most people who fail CC fail for one of three reasons — none of them intelligence.
Breadth
Five domains and nowhere to hide. You need the vocabulary and the why across all five at once.
The adaptive format
No back button, and your first fifteen answers count the most.
Old material
Most free resources still teach the 2022 outline that expired on 31 August 2026.
This course fixes all three in 20 hours: coverage weighted like the 2026 exam, and timed adaptive-style mocks so exam day isn't your first time.
What is the ISC2 Certified in Cybersecurity (CC) certification?
Certified in Cybersecurity (CC) is ISC2’s entry-level credential, launched in August 2022 for people entering cybersecurity without IT experience. It has no prerequisite, grants full ISC2 membership on passing and, at US$199, is the lowest-cost ISC2 exam. It is approved under U.S. DoDM 8140.03 and sits below SSCP, CCSP and CISSP on the ISC2 ladder.
Register
No prerequisite — anyone can book the exam.
Pass
Score 700 / 1000 on the adaptive exam.
Certified member
Apply within 9 months + US$50 annual fee.
Official reference: ISC2 Certified in Cybersecurity page.
What changed in the CC exam on 1 September 2026
On 1 September 2026 ISC2 replaced the CC exam outline for the first time since launch. The exam keeps five domains, but four were renamed and all were re-weighted — and foundational AI concepts now run through every domain.
| 2025 outline (to 31 Aug 2026) | Weight | 2026 outline (from 1 Sep 2026) | Weight |
|---|---|---|---|
| Security Principles | 26% | Security Principles | 24% |
| Business Continuity, DR & Incident Response | 10% | Security Governance | 17.3% |
| Access Controls Concepts | 22% | Identity and Access Management (IAM) Concepts | 20% |
| Network Security | 24% | Networking and Cloud Security Concepts | 21.3% |
| Security Operations | 18% | Security Operations and Incident Response | 17.3% |
Business Continuity, DR and Incident Response became Security Governance — GRC, culture, metrics and key risk indicators — and incident response moved into Domain 5. The other three domains grew: IAM added the identity lifecycle, Networking and Cloud Security added cloud models, shared responsibility and zero trust, and Security Operations and Incident Response added threat intelligence, red/blue/purple teaming, threat modeling and quantum-resistant cryptography. There is no transition window.
The five CC domains — and where the exam actually sits
Security Principles (24%) and Networking and Cloud Security (21.3%) together are 45% of the exam. But the adaptive engine tests all five, so no domain can be skipped.
Domain 1: Security Principles
CIA triad, AAA, non-repudiation, privacy, risk management, control types, policies vs standards vs procedures, ISC2 Code of Ethics.
Coach’s note: The vocabulary domain — every other domain reuses these words.
Domain 2: Security Governance
GRC, security awareness and culture, metrics, KRIs and dashboards, BC/DR as redundancy.
Coach’s note: New in 2026 — it replaced Business Continuity, DR and Incident Response.
Domain 3: Identity and Access Management (IAM) Concepts
Physical and logical access, least privilege, segregation of duties, DAC/MAC/RBAC, identity lifecycle, MFA, IAM tools.
Coach’s note: Every question asks one thing: who are you, what may you do, or what did you do.
Domain 4: Networking and Cloud Security Concepts
OSI and TCP/IP, ports, common attacks, firewalls, IDS/IPS, segmentation, zero trust, wireless, IoT/ICS, cloud models and shared responsibility.
Coach’s note: Learn what breaks at each layer — not the layers as a poem. Cloud is new here.
Domain 5: Security Operations and Incident Response
Encryption and hashing, data handling, logging and SIEM, triage, hardening, security policies, threat intelligence, incident response, red/blue/purple teams, threat modeling.
Coach’s note: The domain that grew the most — and the vocabulary of your first SOC job.
CC exam format, scoring and cost
Issuer
ISC2 (the CISSP body) · launched August 2022
Format
Computerized Adaptive Testing (CAT) at Pearson VUE
Items
100–125, multiple-choice + advanced item types
Duration
2 hours
Passing score
700 / 1000 (scaled)
Languages
English, Chinese, Japanese, German, Spanish
Prerequisite
None — no experience, degree or prior cert
Exam fee
US$199 standard (regional pricing varies)
Staying certified
US$50 annual maintenance fee · 45 CPEs per 3-year cycle
New outline
Effective 1 September 2026 · AI integrated throughout
The exam fee is paid to ISC2 and is separate from Cybernous fees — re-verify on isc2.org before booking.
Is the free ISC2 CC programme still available?
No — public enrolment in ISC2’s One Million Certified in Cybersecurity programme (free training plus a free exam) closed on 20 May 2026. Candidates holding unexpired exam codes may still schedule and test until 31 December 2026. Everyone else pays the standard US$199 exam fee.
I have a code
Book now, not in December. Exams from 1 September 2026 use the new outline, so close the governance, cloud and IAM gaps first.
I don’t have a code
US$199 for an ISC2 credential with no prerequisite is still the best-value entry ticket. Pay for it once.
Who should take CC?
Career switchers with no IT background — CC assumes no prior experience.
Students and freshers — the line that gets the security interview, not the generic IT one.
IT support, networking or sysadmin staff moving across — you already know half of Domain 4.
Aspiring SOC analysts — Domain 5 is your job description: triage, SIEM, threat intel, IR.
Holders of a free 1MCC exam code that expires on 31 December 2026.
How the 20 hours are spent
| Block | Hours | Exam weight | What you finish with |
|---|---|---|---|
| D1 · Security Principles | 4 h | 24% | The vocabulary, AAA, control types, policy vs standard vs procedure, risk lifecycle, the Code of Ethics. |
| D2 · Security Governance | 3 h | 17.3% | GRC, security culture, metrics and KRIs, BC/DR as redundancy. |
| D3 · IAM Concepts | 3.5 h | 20% | Identity lifecycle, DAC/MAC/RBAC, least privilege, MFA, IAM tools. |
| D4 · Networking and Cloud Security | 3.5 h | 21.3% | OSI by "what breaks here", segmentation, zero trust, cloud service and deployment models, shared responsibility. |
| D5 · Security Operations and Incident Response + the AI layer | 3 h | 17.3% | Triage, SIEM, threat intel, IR playbooks, hardening, data handling, how AI touches each domain. |
| Final exam sprint | 3 h | — | Full-length timed CAT-style mocks, review of misses, exam booking and application walkthrough. |
Domains 1 and 4 are 45% of the exam, so they get the most hours. The final block is timed mocks.
Everything in the CC Success Toolkit
Everything runs inside one LMS — notes, questions, mocks, replays, progress and mentor chat.
20 hours of live coaching, recorded for replay
The 20-hour structured plan, weighted to the 2026 exam
Smart notes for all five domains, written for the 2026 outline
An old-versus-new outline map — what moved, appeared or disappeared
A CC-format question bank with explanations that teach the why
Full-length timed CAT-style mocks — 100–125 items, 2 hours
Domain revision days for consolidation
The Confusion Clinic for the classic mix-ups
1:1 mentorship when a concept will not land
Exam booking and ISC2 application walkthrough
A career next-step session (CC → SOC / GRC → SSCP → CISSP)
LMS access plus the alumni community
Led by Karthick AR
Lead instructor — Karthick AR
Karthick AR (CEH, CPISI, ISC2 CC) brings 9+ years across SOC analysis, risk and compliance, and security training — including CCSP, CISSP, CISM, CISA and CEH. He teaches every cohort himself and reviews each student’s mocks one by one.
CC, Security+ or SSCP — which one is yours?
CC (ISC2)
No prerequisite, full membership on passing, US$199. The right first move for a switcher, student or helpdesk engineer.
CompTIA Security+
Also entry-level, but more technical; assumes IT exposure. Easier after CC.
Security+ courseSSCP (ISC2)
Needs a year of paid experience. The natural next step once you're in a role.
Read on SSCPCC → a role → Security+ or SSCP → CISSP at five years.
After CC — the ISC2 ladder and your next 12 months
SOC analyst (Tier 1)
IT security support
IAM administration
GRC / compliance associate
What keeps you climbing is the ladder: SSCP after one year, CISSP after five, CISM towards management, CCSP when your work goes to cloud. Read the SOC analyst starter guide and top cybersecurity certifications for 2026.
2,000+ professionals, coached the same way
CC is a new programme, so we publish no CC pass rate yet — and we won't invent one. It uses the coaching method Manoj Sharma (CISSP, ISC² #557313) built over 29+ years to certify 818+ CISSP professionals at a 98.3% first-attempt pass rate.
Rajesh Kumar
Senior Security Analyst, TCS
“Cybernous training helped me clear CISSP in my first attempt. The hands-on labs and mentoring made all the difference.”
Priya Sharma
CISO, Tech Startup
“The corporate training program transformed our security team. Highly professional and results-driven.”
Ahmed Hassan
Cybersecurity Consultant
“Best investment in my career. The practical approach and exam strategies were invaluable.”
Coached in your timezone, priced for your region
India
Live sessions in IST, fees in INR.
Gulf
Weekend sessions on GST.
APAC
Timed for SGT/AEST cohorts.
Americas
DoDM 8140.03-approved for U.S. defence roles.
Upcoming batch dates for every region are on the training calendar.
Still Deciding? Request a Callback
Tell us your background and we will map your 20 hours, your batch dates and the fee for your region — no pressure.
CC certification — frequently asked questions
Getting started in cybersecurity
Other programmes you may be weighing up
Start Your CC Certification Training
The exam changed on 1 September 2026. Your preparation should have too. Twenty hours, coached live, built on the outline you will actually sit.