Everything you need to know about how the ISC2 CC exam is structured — questions, time, scoring, and exactly how the marks are distributed.
A computerized adaptive test (CAT) of 100 to 125 items with a two-hour maximum, taken in person at a Pearson VUE test centre - ISC2 does not offer CC online. Items are multiple choice plus what ISC2 calls advanced item types; 25 of them are unscored pretest items that look like any other. Difficulty adapts to your answers, so you cannot skip, review or change an answer. The exam stops once the algorithm is 95% confident of the result (from item 100 on), at 125 items or at the time limit, and anyone who has not answered 100 items within two hours fails automatically. The passing standard is 700 out of 1,000 points; ISC2 reports pass/fail rather than a score, with a per-domain proficiency breakdown after a failed attempt. CC has been adaptive since October 1, 2025, and the current outline took effect on September 1, 2026: Security Principles (24%), Security Governance (17.3%), Identity and Access Management (IAM) Concepts (20%), Networking and Cloud Security Concepts (21.3%) and Security Operations and Incident Response (17.3%). Languages: English, Simplified Chinese (in four annual appointment windows only), Japanese, German and Spanish. ExamDeck simulates the single-answer multiple-choice format in fixed-length, non-adaptive mocks; advanced item types and the adaptive engine are not reproduced.
ISC2 publishes how the 100-125 questions are distributed (ISC2 CC Certification Exam Outline, effective September 1, 2026). Weight your preparation to match — this is the single most useful planning fact:
| Domain | Weight | |
|---|---|---|
| Security Principles | 24% | |
| Networking and Cloud Security Concepts | 21.3% | |
| Identity and Access Management (IAM) Concepts | 20% | |
| Security Governance | 17.3% | |
| Security Operations and Incident Response | 17.3% |
Security Principles is the heaviest at 24% — most candidates under-weight it.
6 free questions · explanation for every option · per-area readiness · no dumps.
Start free →Not for new candidates. ISC2 closed new enrolments in its One Million Certified in Cybersecurity program on May 20, 2026. If you already hold an unexpired free exam code from that program, you can schedule and sit the exam until December 31, 2026. Everyone else pays the standard registration fee (US$199 in most regions), and CC-only holders pay a US$50 Annual Maintenance Fee each year after passing.
The exam outline. The CAT format, two-hour limit, 100-125 items and the 700/1000 passing standard are unchanged. The Business Continuity, Disaster Recovery and Incident Response domain (10%) was replaced by Security Governance (17.3%): GRC, redundancy (BC/DR), security awareness and effectiveness metrics such as KRIs and dashboards, while incident response moved into Security Operations and Incident Response. Access Controls Concepts became Identity and Access Management Concepts, adding the identity lifecycle (provision, review, deprovision). New topics include AAA, due care and due diligence, cloud characteristics and the shared security model, Zero Trust, threat actors and cyber threat intelligence, quantum-resistant cryptography and red, blue and purple teaming; on-premises facility items such as HVAC and fire suppression are gone. Prep material written for the earlier outline misses these topics.
No. Items appear one at a time, each chosen according to your previous answers, and you cannot skip, review or change an answer. The exam can stop at item 100 once the algorithm is 95% confident of your result - pass or fail - or continue to 125 items or the two-hour limit. 25 items are unscored pretest items that look exactly like scored ones. Pace yourself: a candidate who has not answered 100 items within two hours (72 seconds per item on average) fails automatically.
A computerized adaptive test (CAT) of 100 to 125 items with a two-hour maximum, taken in person at a Pearson VUE test centre - ISC2 does not offer CC online.
The passing score is 700 out of 1,000 points (a scaled score; ISC2 reports pass/fail and does not release scores). Aim for a consistent 80–85% on realistic practice exams before booking.
ISC2 does not publish official pass rates, so any exact percentage quoted online is unverified. The readiness signal that actually predicts passing: consistently holding 80–85% on realistic, full-length practice exams before you book.
No prerequisites - no cybersecurity work experience or degree is required; ISC2 recommends basic IT knowledge. You must be at least 16 to sit an ISC2 exam; candidates aged 16 or 17 must be accompanied to the test centre by a parent or guardian. No endorsement after passing: you agree to the ISC2 Code of Ethics, submit the certification application within nine months of the exam (otherwise you must retake it) and pay the first US$50 Annual Maintenance Fee.
The standard exam registration is US$199 in most regions (EUR 191.04 in ISC2's EMEA price list, GBP 161.19 in the UK; taxes and local currency depend on the test location - verify on isc2.org). One exam purchase covers one attempt and must be scheduled and sat within 365 days; Peace of Mind Protection bundles two attempts, to be used within 180 days, for less than two single exams. Rescheduling costs US$50 and cancelling US$100. After passing, CC-only holders pay a US$50 Annual Maintenance Fee (AMF) every year. The free One Million Certified in Cybersecurity program closed to new enrolments on May 20, 2026; free exam codes already issued can be used until December 31, 2026.
For most candidates, 15-30 minutes a day plus a couple of hours at weekends (ISC2's own advice; it publishes no total-hours figure). What matters most is practising questions and analysing why each option is right or wrong — not just reading.
valid for a three-year cycle: earn 45 CPE credits per cycle, all Group A (ISC2 suggests 15 a year), and pay the US$50 Annual Maintenance Fee every year - the certification then renews automatically, with no re-exam.
No — every question is original, written to test the concepts and reviewed before it ships, with an explanation linked to the source for every option. Dumps are stale, often wrong, and against ISC2's policies.