ISC2 offers two certifications that people often weigh against each other: Certified in Cybersecurity (CC), its entry-level exam, and the CISSP, its certification for experienced security leaders. They use the same adaptive exam style, but they sit at opposite ends of a security career. Here is how they compare, taken from ISC2’s official pages and exam outlines, followed by our suggestion on which to take first.
The two exams side by side
| Detail | Certified in Cybersecurity (CC) | CISSP |
|---|---|---|
| Level | Entry level | Experienced practitioners, managers and executives |
| Format | Computerized adaptive test (CAT): multiple choice and advanced item types | Computerized adaptive test (CAT): multiple choice and advanced item types |
| Items | 100 to 125, including 25 unscored pretest items | 100 to 150, including 25 unscored pretest items |
| Time | 2 hours maximum | 3 hours maximum |
| Passing grade | 700 out of 1000 points | 700 out of 1000 points |
| Price | US$199 in most regions (EUR 191.04 in Europe, GBP 161.19 in the UK) | US$749 in most regions (EUR 719.04 in Europe, GBP 606.69 in the UK) |
| Delivery | In person at a Pearson VUE test centre | In person at Pearson VUE test centres authorised by ISC2 |
| Languages | English, Chinese, German, Japanese, Spanish | English, Chinese, German, Japanese, Spanish |
| Experience needed | None; basic IT knowledge recommended | 5 years in two or more of the eight domains (one year can be waived) |
| Domains | 5 | 8 |
| Upkeep | 45 CPE credits per three-year cycle and US$50 a year | 120 CPE credits per three-year cycle and US$135 a year |
The exam mechanics are close. The big differences are depth, price and the experience you need to hold the title.
Who each certification is for
CC. ISC2 says CC proves you have the foundational knowledge, skills and abilities for an entry- or junior-level cybersecurity role. There are no specific prerequisites. You do not need cybersecurity work experience or a degree, though ISC2 recommends basic IT knowledge. You must be at least 16 to sit an ISC2 exam. The CC exam outline names the next step as ISC2’s expert-level certifications, which require experience in the field.
CISSP. ISC2 describes the CISSP as validating the technical and managerial knowledge and experience to design, engineer and manage an organisation’s overall security posture. The roles it lists include CISO, director of security, security manager, security architect, security analyst, security auditor and security consultant.
How the adaptive format works on both
ISC2 uses computerized adaptive testing (CAT) for all CC and CISSP exams. After each answer the exam re-estimates your ability and picks the next item. The same rules apply to both:
- You see at least 100 items, and 25 of them are unscored pretest items you cannot identify.
- The exam can end once it is 95% confident whether you are above or below the passing standard.
- You must answer at least 75 scored items plus the 25 pretest items before time runs out, or the result is a fail.
- Item review is not allowed. Once you finalize an answer, you cannot change it.
- Breaks count toward the maximum time.
- Results show pass or fail, not a number. If you fail, you see your proficiency level in each domain.
The CISSP simply runs longer: up to 150 items in 3 hours, against up to 125 items in 2 hours for CC.
CC: the September 2026 outline change
A revised CC outline took effect on 1 September 2026. ISC2 calls it the first major content update since CC launched in August 2022. It still has five domains, but they were renamed and reweighted:
| CC domain from 1 September 2026 | Weight |
|---|---|
| Security Principles | 24% |
| Security Governance | 17.3% |
| Identity and Access Management (IAM) Concepts | 20% |
| Networking and Cloud Security Concepts | 21.3% |
| Security Operations and Incident Response | 17.3% |
Governance is now a domain of its own, with business continuity and disaster recovery inside it. Incident response moved into Domain 5, alongside threat intelligence, threat frameworks and red, blue and purple teaming. Domain 4 adds cloud security, zero trust and modern segmentation, and foundational AI topics are spread across the outline.
Free exam programme closed: ISC2’s One Million Certified in Cybersecurity programme stopped taking new enrollments on 20 May 2026. Unexpired exam codes from it must be used to schedule and sit the exam by 31 December 2026.
CISSP: the April 2027 outline change
The current CISSP outline took effect on 15 April 2024. ISC2 has announced that from 15 April 2027 the exam will follow a new outline. The format stays the same: CAT, 100 to 150 items, 3 hours and 700 out of 1000 to pass. Domain 1 is renamed and every weight changes:
| CISSP domain | Until 14 April 2027 | From 15 April 2027 |
|---|---|---|
| Security and Risk Management (from 2027: Security Governance and Risk Management) | 16% | 13.6% |
| Asset Security | 10% | 12% |
| Security Architecture and Engineering | 13% | 12.8% |
| Communication and Network Security | 13% | 12.8% |
| Identity and Access Management (IAM) | 13% | 13.6% |
| Security Assessment and Testing | 12% | 11.2% |
| Security Operations | 13% | 12.8% |
| Software Development Security | 10% | 11.2% |
The 2027 outline also adds ethics in artificial intelligence to Domain 1. If your exam date is before 15 April 2027, study the April 2024 outline. On or after that date, use the 2027 one.
The Associate of ISC2 route
You can sit the CISSP exam before you have five years of experience. Passing the exam is one step. To be certified you must also meet the experience requirement, be endorsed, pay an annual maintenance fee and commit to the ISC2 Code of Ethics.
- If you pass without enough experience, you can become an Associate of ISC2. You then have six years to earn the required five years.
- A relevant bachelor’s or master’s degree, or a credential on ISC2’s approved list (such as CISM or CompTIA Security+), can count for one year. Only one year can be waived.
- Part-time work of 20 to 34 hours a week and paid or unpaid internships can count.
- Associates pay US$50 a year and need 15 CPE credits each year.
- Once you pass, apply for certification within nine months of your exam date.
Keeping each certification
CC needs 45 CPE credits per three-year cycle (ISC2 suggests about 15 a year) and a US$50 annual fee if CC is your only ISC2 certification. The CISSP needs 120 CPE credits per cycle, at least 90 of them in Group A, and a US$135 annual fee. ISC2 charges members a single annual fee however many of its certifications they hold. Both have a 90-day grace period for CPE credits before the certification is suspended.
Our suggestion: which to take first
This is our suggestion, not ISC2’s. It is based on the official details above.
- You are new to security or IT: start with CC. It needs no experience, costs far less and covers the same broad ground at an entry level: principles, IAM, networking, governance and operations.
- You have a few years in IT but not five in security: CC is a sensible first step while you build experience. If you want to aim for the CISSP early, the Associate of ISC2 route lets you pass now and finish the experience later.
- You already have five years in two or more CISSP domains: you can go straight to the CISSP. ISC2 sets the CISSP requirement in terms of work experience in the domains.
- You are booking the CISSP close to April 2027: pick your date first, then study the outline that applies on that date.
- Either way: practise in timed sessions without going back to earlier questions, because neither exam allows item review. ExamCrest has 10 free practice questions for CC to help you get started.
Confirm the latest details on ISC2’s Certified in Cybersecurity page and CISSP page before you book.
I run ExamCrest, where this post first appeared. Try 10 free ISC2 CC practice questions: https://examcrest.com/exam/isc2-cc/free-questions?utm_source=devto&utm_campaign=sx-isc2-cc-cissp
Top comments (0)