ISC2 rewrites its entry-level CC exam and refreshes CCSP: what candidates need to know

ISC2 is changing two of its certification exams this year. The Certified in Cybersecurity (CC) exam, the organization's entry-level credential, moves to a new outline on Sept. 1, 2026, its first major content update since it launched in August 2022. The Certified Cloud Security Professional (CCSP) exam switched to a new outline on Aug. 1.

The CC matters for newcomers because ISC2 has used it to bring students and career changers into the field. The CCSP is one of the most-cited cloud security credentials. In both cases, the date you sit the exam, not the date you registered, decides which outline you face.

What changes in the CC exam

ISC2 described the update in an Aug. 6 article. The exam keeps five domains, but three are renamed or replaced and the weights shift:

• Security principles: 24 per cent (was 26 per cent)
• Security governance: 17.3 per cent, replacing business continuity, disaster recovery and incident response concepts (10 per cent)
• Identity and access management concepts: 20 per cent, replacing access controls concepts (22 per cent)
• Networking and cloud security concepts: 21.3 per cent, replacing network security (24 per cent)
• Security operations and incident response: 17.3 per cent (was security operations, 18 per cent)

The new governance domain covers governance, risk and compliance, security awareness, security culture and program metrics such as key risk indicators. Business continuity and disaster recovery move under redundancy concepts.

The identity domain adds identity lifecycle management, provisioning and deprovisioning, and role definitions. The networking domain adds cloud fundamentals, including service models and the shared responsibility model, along with zero trust, modern segmentation, wireless, and Internet of Things and industrial control systems.

The operations domain grows the most in scope. It adds event triage, threat actors, threat intelligence and frameworks, incident response planning and exercises, red, blue and purple teaming, application security testing and threat modelling. Data security adds masking, sanitization and quantum-resistant cryptography.

ISC2 says foundational AI topics are woven through the whole outline, so that entry-level candidates can identify AI assets, recognize automated threats and support governance of new technology. The exam also moved from a linear format to computerized adaptive testing during this period.

What changes in the CCSP exam

The CCSP keeps its six domains. ISC2's current outline page lists average weights of 17 per cent for cloud concepts, architecture and design; 20 per cent for cloud data security; 17 per cent for cloud platform and infrastructure security; 16 per cent for cloud application security; 17 per cent for cloud security operations; and 13 per cent for legal, risk and compliance.

The adaptive exam has 100 to 150 items over three hours, with a passing score of 700 out of 1,000. The outline adds AI and machine learning topics, including in cloud concepts and in data security, where it covers protecting AI and machine learning data. ISC2 has added a section explaining how AI security fits across the CCSP domains.

Training provider Destination Certification describes the change as a new outline built from ISC2's job task analysis rather than a change in format, and advises candidates to use study material aligned to the new outline if they test on or after Aug. 1.

What to do

• If you are booked for the CC before Sept. 1 and your preparation is solid, there is no need to reschedule. If you test after that date, use material written for the 2026 outline.
• Expect more governance, identity and cloud questions on the CC, and less on business continuity.
• For the CCSP, check that any book or course you buy is dated after the August outline change.
• Do not rush an exam you are not ready for just to beat a deadline. A failed attempt costs more than a few weeks of extra study.