CC
ISC2 Certified in Cybersecurity
The CC is ISC2's entry-level certification without experience requirements and explicitly targets career starters, career changers, and students. Notably, ISC2 periodically offers CC training and the exam for free (as part of the 'One Million Certified' initiative), which has significantly increased market penetration. Content covers five domains: Security Principles, Incident Response, Access Control, Network Security, and Security Operations – at a solid but intentionally broad entry level. As a stepping stone to SSCP or CISSP it is well-suited; as a standalone credential it carries less weight than Security+. From September 2026, a new Exam Outline applies.
› Quality score
Four-axis SecProve rubric, each 0–10. SecProve editorial assessment — each axis carries a written justification so you can push back on any single call without dismissing the whole score.
› Market signals
public, citable inputs to the recognition scoreFastest-growing ISC2 cert since 2022 launch via the One Million Certified initiative.
› Exam format
100 multiple-choice questions, 2 hours, proctored via Pearson VUE.
30 / 60 / 90 day waits between retakes 1/2/3.
› Recertification
Valid for 3 years. 15 CPE credits/year + annual AMF (50 USD). Free exam for first-time candidates.
› 3-year cost of ownership
Excludes study materials, training, retake risk, and lost-wage opportunity. Use as a floor estimate.
› NICE Framework work roles
The NIST NICE work-role IDs this cert maps to. NICCS lookup.
› Core domains covered
The 2 domains this cert is centrally about. Passing the exam demonstrates working knowledge of each.
› Prerequisites
None. Entry-level certification without professional experience.
› Progression
requiredrecommendedWhere this cert fits in the typical learning path. Required edges are vendor-gated; recommended edges reflect de facto industry progression.
No vendor-gated prereqs.
No de facto priors typically expected.
No certs require this one.
› Study materials
Curated starting points. Not exhaustive — vet each against your learning style and the current exam version.
- ISC2 Free Online Self-Paced Course
- Pete Zerger CC review (YouTube)
› Version & lifecycle
Entry-level vendor-neutral cert from ISC2. Free training under the One Million Certified initiative.
› Salary signal
Entry security analyst / IT generalist, US, 0–2 years.
Glassdoor + Salary.com 'Junior IT/Security' aggregations · 2024 · US base only · p25–p75 range
› How it compares
ISC2 brand + free training vs CompTIA's longer-established hiring-manager recognition.
↔ Compare side-by-side› Careers that commonly pursue this cert
Monitor, detect, and respond to security threats in a Security Operations Center. The front line of cyber defense.
Design, build, and maintain security infrastructure. The architects of an organization's defensive posture.
Analyze adversary behavior, track threat actors, and produce actionable intelligence that drives defensive decisions.
Investigate breaches, contain threats, and perform digital forensics. The first call when an attack is discovered.
Secure cloud infrastructure across AWS, Azure, and GCP. Specialize in the shared responsibility model and cloud-native controls.
Lead security strategy, communicate risk to the board, and build security programs. Executive-level cybersecurity leadership.
Build detection rules, tune SIEM systems, and hunt for threats that evade automated defenses.
Prepare for the post-quantum era. Understand quantum threats and lead cryptographic migration efforts.
Senior design role — defines how pillar A components fit together across identity, crypto, network, cloud, and data — and, increasingly, how pillar C bolts into it.
Owns the end-to-end find → prioritize → fix → verify loop at scale, now increasingly AI-driven.
Secures the platform that trains, stores, and serves ML models — multi-tenant GPU isolation, pipeline integrity, feature-store hygiene, secrets management in ML workflows.
External-first role: inventories what an attacker can see, tracks what's new, and drives closure through the org. The outside-in counterpart to vuln management.
See this cert’s domains highlighted on the interactive map, or compare it against the rest of the catalog.