How to Pass the ISC2 CC Exam in 2026: A 4-Week Study Plan for the New 1 September Objectives

Updated 27 September 2026: this plan has been rebuilt around the ISC2 CC exam outline that took effect on 1 September 2026. The domain names, weightings and weekly schedule below all reflect the current exam.

Four weeks is a realistic ISC2 CC timeline if you can give it eight to ten hours a week. The catch is that most CC study plans online were written for the old outline, and the exam changed on 1 September 2026. Three domains were renamed, business continuity lost its standalone domain, cloud security and security testing arrived, and every weighting moved.

This plan is built for the exam you will actually sit. It covers the current format, the five domains and their weights, and a week-by-week schedule you can start today.

What the ISC2 CC Exam Looks Like in 2026

Get the mechanics straight before you plan a single study session, because the format dictates how you practise.

ISC2 delivers CC as a computerised adaptive test (CAT). You will see between 100 and 125 items in a two-hour appointment, and you need 700 out of 1000 scaled points to pass. The exam is taken through Pearson VUE, at a test centre or under online proctoring, and the standard fee is US$199.

There is no work experience requirement. CC is deliberately the entry point to the ISC2 ladder, which is why it appears in so many junior job adverts.

Exam Tip: Adaptive delivery means you answer each item once and move on. You cannot flag a list of questions and come back to them at the end, so practise committing to an answer under time pressure from week 1.

Once you pass and complete the certification application, you pay a US$50 Annual Maintenance Fee and earn 45 CPE credits across each three-year cycle.

The free voucher deadline

ISC2 closed its One Million Certified in Cybersecurity programme to new enrolments on 20 May 2026. If you enrolled before then, your free exam must be taken by 31 December 2026. A four-week plan started now finishes comfortably inside that window, so do not let the voucher lapse while you wait to feel ready.

The Five Domains You Are Studying For

These are the domains and weightings in ISC2's CC exam outline effective 1 September 2026.

The spread between the largest and smallest domain is now under seven points. Under the old outline, business continuity sat alone at 10% and many candidates skimmed it. There is no domain that cheap any more. Because the exam is adaptive, treat the percentages as a guide to where your revision hours go, not as a promise of exact question counts.

We cover each change in detail in ISC2 CC Domains 2026: The New Exam Outline and Weightings.

Where AI fits

ISC2 did not add an AI domain. It threaded foundational AI concepts through all five existing ones. The outline mentions how AI affects confidentiality, integrity and availability, model drift as a continuity risk, identity management for AI bots, AI-driven incident detection and threat prevention, data leakage through public AI services, and AI in security testing.

None of that is new theory. Each item is an existing CC concept applied to an AI system, which is how the plan below handles it.

If you started revising on the old outline

Your time is not wasted. Most of the content survived, it just moved. Business continuity and disaster recovery now live inside Security Governance, incident response moved into Domain 5, and access controls became part of IAM. The genuinely new material is cloud security, zero trust, identity life cycle management, security testing and governance metrics. Our guide to what changed on 1 September and what to do if you studied the old outline maps old topics to new ones.

The 4-Week ISC2 CC Study Plan

This plan assumes eight to ten hours a week: roughly ninety minutes on five weekdays, plus a two-hour block at the weekend. Stretch it to six weeks if you are working full time and new to IT. If you already hold Security+, two weeks is usually enough.

The sequencing pairs domains that share vocabulary, front-loads the heaviest material while motivation is high, and keeps the final week free for full-length practice.

Week 1: Security Principles and Security Governance (41.3% of the exam)

Domains 1 and 2 overlap heavily. Governance concepts appear in both, so learning them together saves time.

• Day 1: CIA triad, authentication, authorisation and accounting, non-repudiation, privacy. Write your own one-line definition of each term. Add one AI example to each leg of the triad, for instance poisoned training data as an integrity failure.
• Day 2: Risk management. Threat, vulnerability, likelihood, impact, and the treatment options of avoid, accept, mitigate and transfer. Know which is which from a scenario, because that is how the exam asks.
• Day 3: Governance documents and control types. Regulations, frameworks, and the difference between a policy, a standard, a procedure and a guideline. Technical, administrative and physical controls. Due care against due diligence.
• Day 4: The ISC2 Code of Ethics and professional conduct, then GRC planning from Domain 2. The ethics canons take twenty minutes to learn and are free marks.
• Day 5: Redundancy. Business continuity against disaster recovery, RPO against RTO, and where each sits in the timeline of an outage. Add model drift as a continuity risk here.
• Weekend: Security awareness (social engineering, phishing, password practice) and measuring effectiveness through metrics, key risk indicators, dashboards and scorecards. Then take a 30-question checkpoint quiz on domains 1 and 2.

Aim for 70% or better on that checkpoint. If you land lower, the gap is usually terminology rather than comprehension, so re-read your own definitions before moving on.

Week 2: Identity and Access Management and network fundamentals

• Day 1: Identity life cycle management. Role definition, provisioning, access review and deprovisioning. This is new to the outline, so expect scenario questions about a leaver who kept access.
• Day 2: Logical access controls. Least privilege, separation of duties, and the access control models: discretionary, mandatory, role based and rule based. Be able to name the model a scenario describes from one sentence. Apply least privilege to AI bots and other non-human identities.
• Day 3: The OSI and TCP/IP models, IPv4 and IPv6. Several networking items are layer-identification questions in disguise, so do not skim this.
• Day 4: Firewalls, ports and applications, and VPNs. Learn the common port numbers cold: 22, 23, 25, 53, 80, 143, 389, 443, 445, 3389.
• Day 5: Wireless (Wi-Fi and Bluetooth) and embedded systems, including IoT and industrial control systems.
• Weekend: Checkpoint quiz on Domain 3 and the network security topics covered so far.

Week 3: Security architecture, cloud, and Security Operations

• Day 1: Network security architecture. Firewall zones, VLANs, micro-segmentation, defence in depth and zero trust. Frame AI workloads as one more asset class you segment.
• Day 2: Cloud security. Cloud characteristics, service models, deployment models and the shared security model. This whole topic is new to CC, and older books do not cover it.
• Day 3: Data security. Classification, labelling, masking and sanitisation. Encryption: symmetric, asymmetric, hashing, and what quantum-resistant encryption is for. Add data leakage through public AI tools here.
• Day 4: Security operations and incident response. Logging and monitoring, event triage, threat actors, threat intelligence and threat frameworks. The incident response plan and how tabletop exercises test it.
• Day 5: Asset protection and security testing. End-of-life software and devices, configuration and change management. Red, blue and purple teaming, vulnerability scanning, static and dynamic analysis, threat modelling, and physical tests such as tailgating and impersonation.
• Weekend: Checkpoint quiz on the rest of Domain 4 and all of Domain 5.

By the end of week 3 you have covered the whole outline once. Everything after this is consolidation.

Week 4: Full practice exams and weak-area repair

This is the week that separates a comfortable pass from a nervous one, and it is the week most people cut short.

• Day 1: Full-length timed practice exam, two hours, no notes, no pausing.
• Day 2: Review every question you got wrong and every question you guessed correctly. Lucky guesses are hidden gaps.
• Day 3: Targeted revision on your two weakest domains only. Re-reading material you already know feels productive and teaches you nothing.
• Day 4: Second full-length timed practice exam.
• Day 5: Pass through the AI examples you collected in weeks 1 to 3. Each should connect to an existing concept, not stand alone.
• Weekend: Final review of your error log, the Code of Ethics, port numbers, and RPO against RTO. Then stop. Sleep beats another hour of cramming.

Exam Tip: Do not book the real exam for the day after your first 80% practice score. Wait until you hit 80% or higher consistently on full-length timed tests, because scores tend to drop under real exam conditions and 700 out of 1000 leaves less margin than it looks.

The Five Mistakes That Fail CC Candidates

CC has a reputation as an easy exam, and that reputation is exactly why people fail it.

1. Studying passively. Watching a video course from start to finish feels like progress and produces almost no recall. Every session above ends with you writing or answering something.
2. Revising from pre-September material. A book that teaches business continuity as a 10% domain and says nothing about cloud security or security testing will leave gaps in two domains.
3. Skipping the Code of Ethics. It is a small number of items, entirely memorisable, and people leave the marks on the table.
4. Treating scenario questions as definition questions. CC asks you to apply a concept. If you can only define least privilege, you will lose the item describing a contractor who still has admin rights three months after the project ended.
5. Booking the exam too far out. Without a date in the calendar, a four-week plan becomes a four-month plan. Book it at the start of week 2.

We went further into this in why most people fail certification exams, and the fixes there apply directly to CC.

Where CC Fits After You Pass

CC proves you understand the vocabulary of security. It does not prove you can do the job, and it is not meant to.

The natural next step for most people is CompTIA Security+, which covers similar ground at greater depth and carries more weight with hiring managers. Our comparison of ISC2 CC and CompTIA Security+ breaks down which to take first. SY0-701 is the current Security+ exam, and CompTIA has said SY0-801 launches on or around 17 November 2026. Our SY0-801 vs SY0-701 guide helps you decide which version to sit, and the eight-week SY0-801 study plan follows on from this one if you wait for the new exam.

If you are staying with ISC2, CC leads towards SSCP for hands-on operations roles, or CISSP once you have the required experience.

Your Exam Day Checklist

• Book the appointment at the start of week 2, not the end of week 4.
• If you are testing online, read the proctoring rules first. Our guide to OnVUE online proctored exams covers the check-in process and what gets people removed from a session.
• Arrive or log in thirty minutes early. Rushing costs more marks than a missed revision session.
• Answer every item. The adaptive format will not let you skip and return, and a blank earns nothing.
• On ambiguous items, trust your first careful reading of the scenario over your third.

Ready to Start Practising?

A study plan tells you what to cover. Practice questions tell you whether it stuck, and that gap is where most CC failures live.

Use the 20 ISC2 CC practice questions mapped to the current domains as your week 1 checkpoint. Then work through the full question bank, mapped to the five post-September domains with an explanation for every answer, in the ISC2 CC course.

Once you pass, our guide to what to take after ISC2 CC covers the next step, from Security+ to SSCP.

Still weighing up whether to sit the exam at all? Read is ISC2 CC worth it in 2026 first.

Create your free CertCrush account and start your first CC checkpoint quiz today.