Here's the full ISC2 CC cost picture — the ISC2 fees you'll pay, plus how to keep your total down by passing on the first attempt.
| Item | Fee (USD) |
|---|---|
| Exam fee | $199 in most regions (EUR 191.04 in ISC2's EMEA list, GBP 161.19 in the UK; verify on isc2.org) |
| Retake | Full fee per attempt (30-day wait after the first fail, 60 after the second, 90 after later ones; max 4 attempts in 12 months) |
| Reschedule / cancel | $50 / $100 |
| Annual Maintenance Fee | $50 every year (CC-only holders), plus 45 CPE credits per 3-year cycle |
The standard exam registration is US$199 in most regions (EUR 191.04 in ISC2's EMEA price list, GBP 161.19 in the UK; taxes and local currency depend on the test location - verify on isc2.org). One exam purchase covers one attempt and must be scheduled and sat within 365 days; Peace of Mind Protection bundles two attempts, to be used within 180 days, for less than two single exams. Rescheduling costs US$50 and cancelling US$100. After passing, CC-only holders pay a US$50 Annual Maintenance Fee (AMF) every year. The free One Million Certified in Cybersecurity program closed to new enrolments on May 20, 2026; free exam codes already issued can be used until December 31, 2026.
The biggest hidden cost of any certification is the retake — fail once and you pay the exam fee again, plus weeks of lost momentum. The cheapest way to sit ISC2 CC once is to walk in genuinely ready.
That's where affordable practice pays for itself: ExamDeck is $15 for lifetime ISC2 CC access (or $19/month All-Access across every exam) — a fraction of the exam fee — with original questions, an explanation for every option, and a readiness report that tells you when you're ready to book.
6 free questions · per-area readiness · no dumps · no ads.
Start free →Not for new candidates. ISC2 closed new enrolments in its One Million Certified in Cybersecurity program on May 20, 2026. If you already hold an unexpired free exam code from that program, you can schedule and sit the exam until December 31, 2026. Everyone else pays the standard registration fee (US$199 in most regions), and CC-only holders pay a US$50 Annual Maintenance Fee each year after passing.
The exam outline. The CAT format, two-hour limit, 100-125 items and the 700/1000 passing standard are unchanged. The Business Continuity, Disaster Recovery and Incident Response domain (10%) was replaced by Security Governance (17.3%): GRC, redundancy (BC/DR), security awareness and effectiveness metrics such as KRIs and dashboards, while incident response moved into Security Operations and Incident Response. Access Controls Concepts became Identity and Access Management Concepts, adding the identity lifecycle (provision, review, deprovision). New topics include AAA, due care and due diligence, cloud characteristics and the shared security model, Zero Trust, threat actors and cyber threat intelligence, quantum-resistant cryptography and red, blue and purple teaming; on-premises facility items such as HVAC and fire suppression are gone. Prep material written for the earlier outline misses these topics.
No. Items appear one at a time, each chosen according to your previous answers, and you cannot skip, review or change an answer. The exam can stop at item 100 once the algorithm is 95% confident of your result - pass or fail - or continue to 125 items or the two-hour limit. 25 items are unscored pretest items that look exactly like scored ones. Pace yourself: a candidate who has not answered 100 items within two hours (72 seconds per item on average) fails automatically.
A computerized adaptive test (CAT) of 100 to 125 items with a two-hour maximum, taken in person at a Pearson VUE test centre - ISC2 does not offer CC online.
The passing score is 700 out of 1,000 points (a scaled score; ISC2 reports pass/fail and does not release scores). Aim for a consistent 80–85% on realistic practice exams before booking.
ISC2 does not publish official pass rates, so any exact percentage quoted online is unverified. The readiness signal that actually predicts passing: consistently holding 80–85% on realistic, full-length practice exams before you book.
No prerequisites - no cybersecurity work experience or degree is required; ISC2 recommends basic IT knowledge. You must be at least 16 to sit an ISC2 exam; candidates aged 16 or 17 must be accompanied to the test centre by a parent or guardian. No endorsement after passing: you agree to the ISC2 Code of Ethics, submit the certification application within nine months of the exam (otherwise you must retake it) and pay the first US$50 Annual Maintenance Fee.
The standard exam registration is US$199 in most regions (EUR 191.04 in ISC2's EMEA price list, GBP 161.19 in the UK; taxes and local currency depend on the test location - verify on isc2.org). One exam purchase covers one attempt and must be scheduled and sat within 365 days; Peace of Mind Protection bundles two attempts, to be used within 180 days, for less than two single exams. Rescheduling costs US$50 and cancelling US$100. After passing, CC-only holders pay a US$50 Annual Maintenance Fee (AMF) every year. The free One Million Certified in Cybersecurity program closed to new enrolments on May 20, 2026; free exam codes already issued can be used until December 31, 2026.
For most candidates, 15-30 minutes a day plus a couple of hours at weekends (ISC2's own advice; it publishes no total-hours figure). What matters most is practising questions and analysing why each option is right or wrong — not just reading.
valid for a three-year cycle: earn 45 CPE credits per cycle, all Group A (ISC2 suggests 15 a year), and pay the US$50 Annual Maintenance Fee every year - the certification then renews automatically, with no re-exam.
No — every question is original, written to test the concepts and reviewed before it ships, with an explanation linked to the source for every option. Dumps are stale, often wrong, and against ISC2's policies.