ISC2 Certified in Cybersecurity (CC) 2026: The New Exam Outline Explained (Domains, Weights, What’s New)
ISC2 has refreshed the Certified in Cybersecurity (CC) exam. A new exam outline took effect on September 1, 2026. ISC2 calls it the first major content update since CC launched in August 2022. The five-domain structure stays, but three domains have new names, the weights have moved, and foundational AI topics now appear in every domain. If your notes or practice questions were written for the old outline, this guide shows what changed and how to adjust your preparation.
The CC exam at a glance (2026)
- Format: Computerized Adaptive Testing (CAT) in every language
- Length: 2 hours, 100–125 items (multiple choice and advanced item types)
- Passing score: 700 out of 1000
- Languages: English, Chinese, Japanese, German and Spanish (Chinese is offered only in set testing windows)
- Delivery: Pearson VUE testing centers
- Cost: US$199 exam fee, and a US$50 annual maintenance fee (AMF) once you pass
Sources: the official CC exam outline page and ISC2’s One Million Certified in Cybersecurity update.
Old vs new: domains and weights
ISC2 says the update reflects its latest Job Task Analysis (JTA), the survey of what entry-level practitioners actually do. Here is the side-by-side, based on ISC2’s article Inside the Updated ISC2 CC Exam:
| # | 2025 outline | Weight | 2026 outline | Weight |
|---|---|---|---|---|
| 1 | Security Principles | 26% | Security Principles | 24% |
| 2 | Business Continuity (BC), Disaster Recovery (DR) & Incident Response Concepts | 10% | Security Governance | 17.3% |
| 3 | Access Controls Concepts | 22% | Identity and Access Management (IAM) Concepts | 20% |
| 4 | Network Security | 24% | Networking and Cloud Security Concepts | 21.3% |
| 5 | Security Operations | 18% | Security Operations and Incident Response | 17.3% |
The biggest change is Domain 2. It used to be about BC, DR and incident response. Now it covers security governance, and its weight rises from 10% to 17.3%. Incident response moves to Domain 5, and BC/DR are now taught under the idea of redundancy. One small caution: at the time of writing, the short “topics” summary on ISC2’s outline page still shows the old domain names, while the weights table on the same page shows the new ones. Study from the new weights table and the detailed objectives.
What’s new in each domain
Domain 1: Security Principles (24%)
“Information assurance” is replaced by broader cybersecurity concepts. New or expanded topics include AAA (authentication, authorization and accounting), risk management concepts and the risk lifecycle, security frameworks and guidelines, and due care vs due diligence.
Domain 2: Security Governance (17.3%)
This domain is essentially new. It covers governance, risk and compliance (GRC), security awareness and security culture, and how security is measured and reported through metrics, key risk indicators (KRIs), dashboards and reports. Business continuity and disaster recovery now appear here under redundancy.
Domain 3: IAM Concepts (20%)
Access control has grown into identity and access management. Expect questions on the identity lifecycle, provisioning and deprovisioning, role definitions, and IAM frameworks and tools. Least privilege and segregation of duties are still core topics.
Domain 4: Networking and Cloud Security Concepts (21.3%)
Cloud is now explicit: cloud characteristics, service and deployment models, and the shared responsibility model. The domain also adds zero trust and micro-segmentation, plus wireless, IoT and industrial control systems (ICS).
Domain 5: Security Operations and Incident Response (17.3%)
This domain gets the longest list of additions:
- event triage and prioritization
- threat actors and their motivations, cyber threat intelligence (CTI) and threat frameworks
- incident response planning and exercises
- the asset lifecycle
- red, blue and purple teaming
- application security testing and threat modeling
- physical penetration testing concepts
- data masking and sanitization
- quantum-resistant cryptography
AI across all five domains
AI is not a separate domain. Foundational AI security concepts are built into each domain. The outline’s examples include model poisoning, model drift as a business continuity risk, and managing AI bots through the identity lifecycle. You need to understand these concepts at an entry level, not build models.
Who is affected?
- Anyone testing on or after September 1, 2026 takes the new outline. There is no option to sit the old version.
- Self-studiers with older material: books, videos and question banks written before the update will not fully cover governance, cloud, IAM lifecycle, threat intelligence or AI topics.
- One Million Certified in Cybersecurity participants: ISC2 closed the program to new enrollments on May 20, 2026. Exam codes that have not expired must be used by December 31, 2026, so if you have one, book soon. People who enrolled before May 20 keep their course access until it expires, and you don’t need to finish the course to sit the exam (ISC2 1MCC page).
- New candidates now pay the standard US$199 exam fee.
A 4-week study plan for the 2026 outline
This plan assumes about 6–8 hours a week and little or no security background. Spend more time on the domains you find hardest.
| Week | Focus | Goal |
|---|---|---|
| 1 | Domain 1 + Domain 2 | CIA triad, AAA, risk lifecycle, frameworks, due care/diligence, GRC, KRIs and metrics, awareness programs |
| 2 | Domain 3 + Domain 4 | Identity lifecycle, least privilege, SoD, OSI/TCP-IP basics, cloud service and deployment models, shared responsibility, zero trust |
| 3 | Domain 5 + AI topics | Triage, IR lifecycle, CTI, team colors, data handling and sanitization, cryptography basics, AI risks in each domain |
| 4 | Full-length practice + review | Two or three timed 100+ question sets, review every wrong answer against the official objectives, then book the exam |
Need realistic practice for week 4? Our ISC2 CC practice exam gives you full timed tests with explanations. To try it first, the CC practice exam trial costs $1, and that $1 is deducted when you upgrade to the full version.
Common traps on the updated exam
- Studying from the old domain list. If your material still has a “BC, DR & Incident Response” domain at 10%, it’s out of date. Governance now carries 17.3%.
- Treating governance as “just policy”. Expect questions on metrics, KRIs, dashboards and building a security culture, not only policies and standards.
- Mixing up due care and due diligence. Due diligence is researching and understanding the risk; due care is acting reasonably on what you found. Be clear on which is which.
- Getting shared responsibility wrong. Know what the customer owns in IaaS, PaaS and SaaS.
- Ignoring AI. AI questions can come up in any domain, so don’t save it for the end.
- Misreading CAT. The exam adapts to you, and ISC2 does not allow item review: once you finalize an answer, you can’t change it. Answer carefully and pace yourself over the 2 hours.
Where to go after CC
CC is an entry point. Many candidates move on to SSCP for hands-on operations roles, or later to CISSP once they have the required experience. When you’re ready, try our SSCP practice exam or CISSP practice exam.
FAQ
When did the new CC exam outline take effect?
On September 1, 2026. Every CC exam on or after that date uses the updated outline.
Does CC still have five domains?
Yes. ISC2 kept five domains but renamed three of them (Security Governance, IAM Concepts, and Networking and Cloud Security Concepts) and expanded Security Operations to include incident response.
How many questions are on the CC exam, and what is the passing score?
The CAT exam has 100–125 items over 2 hours. You need 700 out of 1000 to pass.
Is the CC exam still free?
Not for new candidates. The One Million Certified in Cybersecurity program closed to new enrollments on May 20, 2026, and the exam fee is now US$199. If you already have an exam code that hasn’t expired, you must use it by December 31, 2026. After you pass, there is a US$50 annual maintenance fee.
Can I still use my old CC study material?
Partly. Security principles, access control basics, networking and operations are still tested, but you’ll need to add governance, cloud, IAM lifecycle, threat intelligence, newer SecOps topics and AI. Check every topic against the official 2026 outline.
Facts in this article come from official ISC2 pages as of October 2026. Always check the ISC2 CC page before you book.
