ISC2 Certified in Cybersecurity (CC)
Demonstrate foundational competence across core security principles, business continuity and disaster recovery, physical and logical access controls, network security architecture, and security operations.
Official Exam Specification & Quick Facts
Question Difficulty Breakdown
Exam Guidelines & Simulation Rules
Frequently Asked Questions (FAQ)
The CC is a foundational cybersecurity credential from ISC2 designed for entry-level professionals, career changers, and students proving mastery of fundamental security concepts.
The CC exam consists of 100 multiple-choice questions to be completed within 120 minutes administered at Pearson VUE testing centers.
The passing scaled score is 700 out of 1000 points (70%). Results are provided upon exam completion.
Domains include: (1) Security Principles (26%), (2) Business Continuity (BC), Disaster Recovery (DR) & Incident Response Concepts (10%), (3) Access Controls Concepts (22%), (4) Network Security (24%), and (5) Security Operations (18%).
Authentication verifies who you are (username/password). Authorization determines what resources you can access. Accounting tracks what you did (audit logs, timestamps).
Physical controls guard physical facilities and assets (fences, badge readers, security guards, biometric locks). Logical (technical) controls protect data and systems (firewalls, passwords, ACLs, encryption).
Business Continuity ensures critical business functions continue operating during an interruption. Disaster Recovery focuses specifically on restoring technology infrastructure, data, and systems after a disaster.
Defense in Depth implements multiple layers of complementary security controls (administrative, physical, and technical) to protect organizational assets.
Policies are high-level mandatory executive management directives. Standards are mandatory specific technical baselines. Guidelines are non-mandatory recommendations. Procedures are step-by-step instructions.
Symmetric encryption uses a single shared secret key for encryption and decryption. Asymmetric encryption uses a public key to encrypt and a mathematically linked private key to decrypt.
Administrative (policies, training, hiring). Technical (firewalls, encryption, antivirus). Physical (locks, fences, CCTV, environmental controls).
Entry-level IT professionals, recent graduates, helpdesk technicians, and professionals transitioning into cybersecurity who want an internationally recognized ISC2 foundation.