CC Certification Training — a 20-Hour ISC2 Course Built on the 2026 Exam Outline

CIA triad; authentication, authorization and accounting (AAA); non-repudiation; privacy; risk management concepts and lifecycle; technical, administrative and physical controls; governance elements — policies, standards, procedures, frameworks, guidelines, regulations and laws; ISC2 Code of Ethics with due care and due diligence.

Coach’s note: This is the vocabulary domain. Every other domain reuses these words. If you can explain the difference between a policy, a standard and a procedure to a friend in one line each, you own this domain.

Governance, Risk and Compliance (GRC); organisational security awareness and cybersecurity culture; measuring programme effectiveness with metrics, key risk indicators (KRIs), dashboards and reports; business continuity and disaster recovery, now covered as redundancy concepts.

Coach’s note: This is the domain that did not exist before September 2026 — it replaced Business Continuity, DR and Incident Response. An entry-level analyst is far more likely to be asked to update a risk dashboard or run an awareness campaign than to invoke a DR plan.

Physical and logical access controls; least privilege and segregation of duties; DAC, MAC and RBAC; identity lifecycle — provisioning, review and deprovisioning; role definitions; IAM frameworks and tools; multi-factor authentication and AI-assisted anomaly detection such as impossible-travel logins.

Coach’s note: Identity is the perimeter now. Very simple rule: every question here is asking one of three things — who are you, what may you do, or what did you do. Decide which one before you look at the options.

OSI and TCP/IP models; IPv4 and IPv6; ports and applications; threats such as DDoS, malware, man-in-the-middle and side-channel attacks; IDS, IPS and firewalls; segmentation — DMZ, VLAN, VPN, micro-segmentation; defence in depth; NAC; zero trust; wireless; IoT and industrial control systems; cloud characteristics, service models, deployment models and the shared responsibility model.

Coach’s note: Do not memorise the seven OSI layers as a poem. Ask what breaks at each layer and what you would use to fix it — that is how the exam frames it. Cloud is new here: know who is responsible for what in IaaS, PaaS and SaaS.

Encryption basics — symmetric, asymmetric, hashing; data handling, classification, retention and destruction; data masking and sanitisation; quantum-resistant cryptography awareness; logging, monitoring and SIEM; security event triage and prioritisation; configuration management and hardening; security policies — AUP, BYOD, password, change management, privacy; awareness training; threat actors and motivations; cyber threat intelligence and threat frameworks; incident response planning and exercises; asset lifecycle; readiness testing with red, blue and purple teams; application security testing, threat modeling and physical penetration-testing concepts.

Coach’s note: This is the 'doing' domain and it grew the most in 2026 — incident response moved in here. If you want a SOC seat, this is the domain to over-prepare, because this is the vocabulary of your first job.