ISACA is killing off its entry-level cybersecurity credential. The last day to purchase the ISACA Cybersecurity Fundamentals Certificate exam or its exam prep is 1 December 2026, and the programme is sunset on 1 June 2027. ISACA is pointing new candidates at its Certified Cybersecurity Specialist (CCS) instead.
If you are shopping for a first cybersecurity certificate right now, the short answer is that this one is a poor buy at this point in its life, with one narrow exception covered below. If you already hold it, you keep it and nothing is taken away.
Almost every page currently ranking for this certificate still presents it as a live, freely purchasable credential with no end date attached. Here is what ISACA has actually published.
The two dates that matter
ISACA has put two hard dates on the certificate page, and they do different things.
1 December 2026 is the commercial cut-off. After that date you cannot buy the exam, and you cannot buy ISACA's exam prep materials for it either. That is roughly twelve weeks from now.
1 June 2027 is when the programme ends. ISACA's wording is that the Cybersecurity Fundamentals Certificate programme "will be sunset" on that date.
The gap between the two dates is your sitting window. Buy the exam on 30 November 2026 and you still have six months to schedule and pass it before the programme closes. Buy nothing, and after 1 December the decision is made for you.
Exam Tip: The 1 December cut-off covers exam prep as well as the exam itself. If you want ISACA's own study material for this certificate, it has to be purchased in the same window.
Does the certificate you already hold still count?
Yes. A sunset programme means ISACA stops selling and administering the exam, not that it revokes credentials people have earned.
This is worth being clear about because it is the most common panic when a vendor retires something. Retirement is forward-looking. It removes the route in for new candidates. It does not reach backwards and delete the badge on your profile or the line on your CV.
What does change is the market's reading of it. A credential that no longer exists gets progressively harder for a hiring manager to place, and there will be no updated version of it to point to. Two years after the sunset, "ISACA Cybersecurity Fundamentals" on a CV is a historical artefact rather than a current qualification. That matters more for a foundational certificate than it would for a flagship like CISA or CISM, because the whole job of an entry-level credential is to signal that you are current.
What the exam covers while you can still buy it
The Cybersecurity Fundamentals Certificate is a proctored, two-hour exam with a pass mark of 65%. ISACA prices it at US$120 for members and US$144 for non-members, which makes it one of the cheapest vendor-backed entry credentials in security. ISACA's certificate page publishes the duration and the pass mark but does not list a question count.
The four domains and their weightings:
| Domain | Weight |
|---|---|
| Securing Assets | 35% |
| Information Security Fundamentals | 27% |
| Security Operations and Response | 20% |
| Threat Landscape | 18% |
Over a third of the exam sits in Securing Assets, which is where candidates most often underprepare because it is the least glamorous material. Network and endpoint hardening, access control and data protection carry more marks than the threat content that people find interesting enough to revise first.
The certificate is knowledge-based rather than experience-based. There is no work-experience requirement, no endorsement process and no annual maintenance fee, which is exactly why it appealed to career changers.
What replaces it: ISACA CCS
ISACA names the Certified Cybersecurity Specialist (CCS) as the successor. It is described as a vendor-neutral certification for early-career professionals and IT staff moving into cybersecurity, built around three practice areas:
- Cybersecurity Principles and Techniques
- Security Operations
- Secure By Design
Here is the part that changes the decision. As of early September 2026, CCS is still in beta. ISACA's CCS page confirms the beta application period has closed and the beta programme is in progress, and it lists the review manuals, the online review course and the Q&A database as "coming soon".
So the successor is not yet a finished product with published pricing, a published exam format or available study materials, while the predecessor stops selling in twelve weeks. There is a real window where neither option is comfortable for someone who wants to start studying this month.
We have covered the replacement in more depth in ISACA CCS Explained: Domains, Cost and Is It Worth It in 2026?, and that post gets updated as ISACA publishes exam specifics.
Should you buy it before 1 December 2026?
Three different readers, three different answers.
Buy it if you are already most of the way through studying
If you have worked through the material, booked study time, or bought third-party prep, finish the job. You will pass a two-hour 65% exam you have already revised for, and you will hold a credential that stays valid. Abandoning sunk study to wait for a beta certification with no published format is the worse trade.
Skip it if you are starting from zero
You would be buying into a credential with a twelve-week purchase window and an eighteen-month shelf life as a current qualification. It undercuts Security+ by around $295, and that saving is not worth pinning your first CV line to something that stops existing in June 2027. Put the money into a certification that will still be issued in 2028.
Skip it if you are choosing between this and CCS
Waiting for CCS to reach general availability is the more sensible play, provided you can wait. ISACA is putting its entry-level effort behind CCS, so that is the credential that will have current study material, active question banks and recognition growing rather than shrinking.
If waiting is not an option because you need something on your CV this quarter, take Security+ or ISC2 CC instead and treat CCS as a later addition.
The two alternatives actually worth comparing
The Reddit thread sitting on page one for this certificate is titled "CompTIA Security+ vs ISACA Cybersecurity Fundamentals", which tells you what people are really deciding between. ISC2 CC is the third option in that decision.
| ISACA Cybersecurity Fundamentals | ISC2 CC | CompTIA Security+ (SY0-701) | |
|---|---|---|---|
| Exam price (USD) | $120 member / $144 non-member | $199 | $439 direct from CompTIA (from 1 June 2026) |
| Ongoing fee | None | $50 annual maintenance fee | CEU renewal every three years |
| Pass mark | 65% | 700 out of 1000 (scaled) | 750 out of 900 |
| Status | Stops selling 1 Dec 2026, sunset 1 Jun 2027 | Current | Current, SY0-801 in development |
| Employer recognition | Low and falling | Moderate and rising | Highest of the three |
Security+ is the expensive option and the one that clears HR filters, including DoD 8140 work-role requirements. ISC2 CC is the cheap middle ground with a small annual fee. Our ISC2 CC vs CompTIA Security+ breakdown compares those two directly.
If you specifically want to stay inside ISACA's ecosystem and you have some hands-on exposure already, ISACA CCOA is the technical operations credential that is current, not retiring, and considerably more respected than the fundamentals certificate ever was.
Frequently Asked Questions
How much does the ISACA Cybersecurity Fundamentals exam cost?
ISACA prices it at US$120 for members and US$144 for non-members. That pricing holds until the exam stops being sold on 1 December 2026.
Which ISACA certification is the easiest to obtain?
The Cybersecurity Fundamentals Certificate has been the easiest entry point, because it has no work-experience requirement, no endorsement step and a 65% pass mark. Once it sunsets, CCS takes that position for people new to security, and CCOA becomes the easiest of ISACA's experience-backed technical certifications.
Is the ISACA Cybersecurity Fundamentals Certificate worth it in 2026?
Only if you have already invested study time in it. For a new candidate the twelve-week purchase window and the June 2027 sunset outweigh the low price, and Security+ or ISC2 CC will carry further with employers.
What is the best certification for a cybersecurity beginner?
CompTIA Security+ has the strongest employer recognition and is the safest single choice. ISC2 CC costs less than half as much and is a reasonable first step if budget is the constraint. ISACA CCS may join that shortlist once it exits beta and ISACA publishes its exam format and pricing.
Does my Cybersecurity Fundamentals Certificate expire on 1 June 2027?
No. The programme is retired on that date, not the credentials already issued. Your certificate remains valid and verifiable, though its value as a signal of current knowledge will decline as the certificate disappears from ISACA's catalogue.
Ready to Start Practising?
If this has pushed you towards a certification with a future rather than a sunset date, the fastest way to find out where you stand is to sit realistic questions rather than read another syllabus.
CertCrush has full practice banks with worked explanations for ISACA CCOA and the rest of the ISACA track, so you can see which domains you would actually pass today.
Create a free CertCrush account and start with a diagnostic run.