Is ISC2 CC Still Worth It in 2026? The Free Exam Ended and the Outline Changed

Short answer: ISC2 CC is still worth it if you want a low-cost, low-risk first security credential from the organisation behind CISSP, and you will actually keep it up. It is no longer worth it as a free bonus, because the free exam is gone. ISC2 closed new enrolments in its One Million Certified in Cybersecurity program on 20 May 2026, and the exam now costs US$199 in most regions. On top of that, every certified CC holder pays a US$50 Annual Maintenance Fee each year. The exam itself also changed: a new outline took effect on 1 September 2026, the first major content update since CC launched in August 2022. Every price, date and rule below was checked on isc2.org on 26 October 2026.

What changed in 2026

Two separate changes landed this year. The first is the price, the second is the content.

Sources: ISC2 program conclusion announcement, ISC2 CAT announcement, CC exam outline.

The free program was large. ISC2 says more than 1 million people in 178 countries enrolled, over 570,000 completed the course and more than 65,000 earned CC. Its announcement also says that the CC exam and education "will be available for purchase like all ISC2 exams and courses". That sentence changes the value question. When CC was free, the only cost was your time. Now it is a paid credential with a yearly fee, and it has to compete with other entry-level options on its merits.

If you still hold a free exam code: ISC2 says unexpired codes can be used to schedule and sit the exam until 31 December 2026. That gives you about nine weeks from the date of this article. Book now, because CC is delivered at test centres only and popular slots fill up.

What CC costs now

ISC2 notes that prices and taxes depend on where you take the exam. The Peace of Mind page does not show a CC price without adding the exam to the cart, so we do not quote one. Purchases are final.

So the realistic minimum is US$199 for one attempt plus US$150 in maintenance fees over three years, about US$349, before training. A failed attempt costs the full fee again. Our CC cost page keeps the fee list in one place.

What changed in the content on 1 September 2026

ISC2 kept five domains, but renamed most of them and moved the weight. The old weights come from ISC2's own breakdown of the update, the new ones from the current exam outline.

Four shifts matter most if you are choosing study material:

• Governance became a domain of its own. Security Governance covers governance, risk and compliance (GRC), security awareness, cybersecurity culture and program metrics such as key risk indicators (KRIs), dashboards and reports. Business continuity and disaster recovery did not disappear, but ISC2 now treats them as redundancy concepts.
• Identity, not just access. The IAM domain adds the identity lifecycle, provisioning and deprovisioning, role definitions and IAM frameworks. Least privilege and separation of duties stay at the core.
• Cloud and Zero Trust. The networking domain now includes cloud characteristics, deployment and service models, the shared responsibility model, Zero Trust architecture, wireless, IoT and industrial control systems.
• Incident response and threats moved into operations. The last domain adds event triage, threat actors, cyber threat intelligence, threat frameworks, incident response exercises, red, blue and purple teaming, application security testing and quantum-resistant cryptography.

ISC2 also says that foundational AI topics are now spread across the whole outline. In Security Principles, it adds authentication, authorization and accounting (AAA), the risk management lifecycle, and due care and due diligence.

The practical consequence: a book, video course or question set written for the 2022 outline has no Security Governance domain, which is now worth 17.3%, and misses most of the new topics above. Check the publication date before you buy, and look for the words "Security Governance" in the table of contents.

What did not change

Sources: CC exam outline, CC certification page, ISC2 CAT announcement.

The adaptive format is the part most first-time candidates underestimate. According to ISC2, each candidate starts with an item below the passing standard, and every following item is chosen so you have roughly a 50% chance of answering it correctly. The exam ends once the algorithm is 95% confident that you are above or below the pass point. To get a result at all, you must answer at least 75 scored items plus the 25 pretest items. So a 100-item exam is not a sign that you did badly, and a 125-item exam is not a sign that you did well. Our CC exam format page explains the rules in more detail.

ISC2 reports pass or fail only. If you fail, you get a domain proficiency breakdown at the test centre (after your exam). Retakes follow ISC2's standard policy: 30 test-free days after the first attempt, 60 after the second, 90 after the third and any later one, and no more than four attempts in 12 months. ISC2 publishes no pass rate, so we do not give one.

Who CC is worth it for

The weak spot is the yearly fee. A CC that lapses because you stopped paying US$50 a year or did not log 45 CPE credits in three years is worth less than no CC at all on a CV. Before you buy, decide whether you will maintain it for at least one cycle.

The other weak spot is depth. CC is a foundations exam. It shows that you understand the concepts, not that you can run a SOC shift or harden a cloud account. Treat it as a first step, not a destination.

CC or Security+?

These are the two entry points most people compare. ISC2 published its own comparison when CC launched, and the basic picture still holds. CC is narrower and has no experience recommendation. Security+ is broader, has performance-based items and has a CompTIA version change coming. If you are weighing the two, read our Security+ SY0-701 vs SY0-801 guide for the dates, then decide based on which name appears in the job ads you are answering. If both appear, start with the one your budget and timeline allow, and add the other only if a specific employer asks for it.

How to prepare under the new outline

ISC2 sells an official self-paced course and lists self-study resources on its site. It does not publish an official number of study hours, and neither do we. Our CC how-to-pass page gives a week-by-week plan.

Three rules for the 2026 outline:

1. Start with Security Principles. At 24% it is still the largest domain, and AAA, risk management and due care run through the rest of the exam.
2. Give Security Governance real time. It is new, it is worth 17.3%, and older material barely covers it.
3. Practise without going back. In a CAT exam you cannot skip, review or change an answer. Practise answering each question once and moving on.

Our ISC2 CC practice questions follow the new five-domain outline. They are multiple-choice scenario questions in fixed-length mocks. We do not reproduce the adaptive engine or the advanced item types. The CC overview and the eligibility page cover the rest. If you are still choosing between certification families, start at the which certification hub.

Verdict

In 2025 the question was "why not?", because the exam was free. In 2026 the question is "will I use and keep it?". If CC is your first security credential, you can afford about US$349 over three years, and you plan to move on to SSCP, CISSP or a role that asks for ISC2, it is still a sensible first step. If you already hold an entry-level security certification, or your target employers only ask for Security+, spend the money elsewhere. And if you still have a free code, book a test centre slot this week. The code expires on 31 December 2026.

Prices, reschedule and cancellation fees verified on ISC2's exam pricing page on 26 October 2026. End of the free program from ISC2's 22 April 2026 announcement. Format, domains, weights, passing standard, languages and delivery from the CC exam outline effective 1 September 2026, and old weights from ISC2's breakdown of the update. CAT rules from ISC2's CAT announcement, retake rules from after your exam, maintenance from the AMF overview and member policies. ISC2 publishes no pass rate and no official study hours, so we give neither.