Short answer: take ISC2 CC first if you are new to IT and want the cheapest, narrowest first step. Take Security+ first if you already work in IT, if the job ads you are answering name it, or if you only want to pay for one entry-level exam. The two certifications do not build on each other, and most people need only one of them. CC costs US$199 in most regions, asks for no experience and is taken at a test centre only. Security+ is broader, includes performance-based tasks, can be taken online, and CompTIA recommends two years of hands-on experience as a security administrator. Security+ also changes version this month: SY0-801 is due on 17 November 2026. Every fact below was checked on isc2.org and comptia.org on 1 November 2026.
The two exams side by side
| ISC2 CC | CompTIA Security+ | |
|---|---|---|
| Current exam | Outline effective 1 September 2026 | SY0-701 (V7); SY0-801 (V8) from 17 November 2026 |
| Questions | 100-125, adaptive (CAT), 25 unscored pretest items | Maximum of 90, multiple-choice and performance-based |
| Time | 2 hours | 90 minutes |
| Passing standard | 700 out of 1,000 | 750 on a scale of 100-900 |
| Delivery | Pearson test centres only | Pearson VUE test centre or online (OnVUE) |
| Experience | None required | Recommended, not required: two years as a security administrator (V8) |
| Languages | English, Chinese, Japanese, German, Spanish | V7: English, Japanese, Portuguese, Spanish, Thai. V8 at launch: English |
| Exam fee | US$199 / EUR 191.04 / GBP 161.19 | Set per country, see below |
| Renewal | US$50 a year + 45 CPE credits per three years | Every three years: 50 CEUs + US$150 CE fee, or another route |
Sources: CC exam outline, ISC2 exam pricing, Security+ V7 page, Security+ V8 page, CompTIA online testing.
Two rows matter more than the rest: experience and delivery. CC is built for people with no security job yet, and ISC2 says so on its CC page ("no work experience required"). Security+ assumes you have touched real systems, and its performance-based questions test that. On delivery, if the nearest Pearson centre is far away, Security+ is the only one of the two you can take at home.
What each exam actually tests
CC is a concepts exam. Its five domains, effective 1 September 2026, are Security Principles (24%), Security Governance (17.3%), Identity and Access Management (20%), Networking and Cloud Security (21.3%) and Security Operations and Incident Response (17.3%). You need to know what least privilege, the shared responsibility model or a risk register is, and pick the right answer in a scenario. You do not configure anything.
Security+ is a concepts-plus-tasks exam. SY0-701 weights Security Operations at 28%, Threats, Vulnerabilities, and Mitigations at 22%, Security Program Management and Oversight at 20%, Security Architecture at 18% and General Security Concepts at 12%. The performance-based questions are interactive: you order steps, match items or work with a simulated setting. That is the real difference in difficulty. A CC candidate who can define a firewall rule may still struggle when asked to read a log and choose which rule to write.
The overlap is large. Both cover security principles, access control, network security, incident response and governance. The gap is depth and practice, not topic list. If you pass CC and then prepare for Security+, you will reuse most of your vocabulary, but you will still need to learn the hands-on parts.
ISC2 and CompTIA publish no pass rate for either exam, so we do not give one.
What each costs over three years
| Item | ISC2 CC | CompTIA Security+ |
|---|---|---|
| First attempt | US$199 | Not quoted here (see below) |
| Retake | Full fee again; wait 30 days after the first attempt, 60 after the second, 90 after later ones; max 4 attempts in 12 months | Full fee again; no wait before the second attempt, 14 days before the third and later ones |
| Yearly fee | US$50 Annual Maintenance Fee, due on each certification anniversary | None |
| Renewal | 45 CPE credits per three-year cycle (ISC2 suggests 15 a year) | 50 CEUs and a US$150 CE fee per three-year cycle, or pass the latest exam, or earn a higher CompTIA certification, or complete CertMaster CE |
| Three-year minimum, one attempt | About US$349 | Exam price + US$150 if you renew with CEUs |
Sources: ISC2 exam pricing, ISC2 after your exam, ISC2 AMF overview, ISC2 member policies, CompTIA retake policy, CompTIA CEU requirements, CompTIA CE fees.
Why there is no Security+ price in this table. CompTIA sets voucher prices by country, and on 1 November 2026 neither the V7 nor the V8 page showed a price. The figures that circulate online come from blog posts with older dates or from training partners. Rather than print a number we cannot trace to a current CompTIA page, we leave it out. Check the CompTIA store for your country before you decide. Whatever the local price is, it is the number to compare with CC's US$199 plus US$150 in maintenance fees.
The fee models also work differently. CC is cheap to sit and costs a little every year. Security+ costs more to sit and nothing in between, but renewal by CEUs costs US$150 per cycle. Note also that CompTIA's CE fee applies only if you renew by uploading CEUs. Passing the latest version of the exam renews Security+ without it.
The DoD 8140 question
For US federal and defence contractor jobs, the question is often not "which is better" but "which does my work role accept". Both vendors say their certification is approved under DoD Manual 8140.03:
- CompTIA says Security+ is approved for 9 work roles, and that CompTIA as a whole has 7 certifications approved across 30 work roles.
- ISC2 said in July 2024 that CC is approved for 20 of the 54 work roles in the DoD 8140 marketplace.
Do not read these as a ranking. They are each vendor's own count, published at different dates, and CompTIA notes that 8140.03 lets DoD workers choose between certification and training options. The number that matters is whether your target work role lists the certification. Check that role in the official DoD 8140 qualification matrix, and check the job ad, before you pay for either exam.
Which to take first
| Your situation | Take first | Why |
|---|---|---|
| Career changer, no IT job yet | CC | No experience needed, lower fee, and it teaches the vocabulary interviews test |
| Student planning SSCP or CISSP later | CC | Same organisation, same CPE model and Code of Ethics as the later ISC2 credentials |
| Helpdesk or sysadmin moving into security | Security+ | You already have the hands-on base its performance-based items test |
| Job ads in your market name Security+ | Security+ | Match the ad. A second entry credential adds little |
| Target is a specific US DoD work role | Whichever that role lists | Check the qualification matrix first |
| No Pearson centre within reach | Security+ | CC is test-centre only; Security+ can be taken online |
| Already hold one of the two | Neither | Move to the next level instead of a second entry exam |
ISC2's own 2022 comparison frames it the same way: CC as the entry point for newcomers, Security+ for people with IT administration experience. That article quotes the free CC exam, which ended for new enrolments on 20 May 2026. Our CC worth-it guide covers what changed when the free program closed.
Should you take both? Usually not. They sit at the same level and cover the same ground, so a hiring manager learns little from the second one. The exceptions are a specific employer that asks for both by name, or a DoD role that accepts one and a contract that requires the other.
The Security+ version change this month
If you choose Security+, the timing matters. SY0-801 is due on 17 November 2026 in English, and SY0-701 retires in English on 11 June 2027. V8 shifts the weights: General Security Concepts rises to 16%, the threats domain (renamed Threats, Vulnerabilities, and Attacks) to 24%, and program management drops to 14%. AI-related risks become an explicit topic. Both versions lead to the same certification, valid for three years.
If you start studying now and can sit before spring 2027, SY0-701 has more mature study material. If your exam date is later, prepare for SY0-801. Our SY0-701 vs SY0-801 guide has the full timeline and the voucher rules for the changeover.
CC changed too, on 1 September 2026, when Security Governance became a domain of its own. A CC book written for the 2022 outline misses it.
How to prepare
For CC, start with Security Principles (24%) and give the new Security Governance domain real time. The exam is adaptive, so you cannot skip or go back. Practise answering each question once and moving on. Our CC how-to-pass page has a week-by-week plan, and the CC exam format page explains the adaptive rules.
For Security+, start with Security Operations, the largest domain in both versions, and practise the hands-on side as well as the theory. Our practice sets are grouped by the SY0-701 domains:
ExamDeck's ISC2 CC practice questions and Security+ practice questions are multiple-choice scenario questions in fixed-length mocks. We do not reproduce CC's adaptive engine, CC's advanced item types or Security+ performance-based tasks. For costs and entry rules in one place, see the CC cost page, the Security+ cost page, the CC eligibility page and the Security+ eligibility page. The side-by-side comparison page puts both fact sheets next to each other.
Verdict
Pick one, not both. If you have never worked in IT, CC is the smaller and cheaper first step, as long as you are willing to pay US$50 a year to keep it. If you already work in IT or the jobs you want name Security+, go straight to Security+ and plan around the 17 November version change. In both cases, read three or four job ads in your market before you buy. The name that appears in them is the one that pays back. Still choosing between families? Start at the which certification hub, or read the CC overview and the Security+ overview.
CC price, reschedule and cancellation fees from ISC2's exam pricing page; format, domains, weights, delivery and languages from the CC exam outline; retakes from after your exam; maintenance from the AMF overview and member policies. Security+ format, weights, experience, languages and dates from the V7 and V8 pages; retakes from the retake policy; renewal from the CEU and CE fee pages. DoD 8140 counts from CompTIA and ISC2. All checked 1 November 2026. Neither vendor publishes a pass rate or official study hours, and we could not find a current Security+ voucher price on a CompTIA page, so we give none of these.