Cybersecurity is no longer a field only for people who have spent years working in IT. Today, people enter cybersecurity from software development, networking, system administration, help desk, cloud computing, university, and even completely different careers.
If you are interested in what the ISC2 Certified in Cybersecurity (CC) is it is designed specifically for beginners to get started in cybersecurity. The very first step in fact.
.
The CC certification is an entry-level cybersecurity certification from ISC2, the organization best known for certifications such as CISSP. ISC2 says the CC is designed for people entering cybersecurity and that no work experience is required. It is intended to prove that a candidate understands the foundational knowledge needed for an entry or junior-level cybersecurity role.
But there is an important question: Is the ISC2 CC actually useful, or is it just another beginner certification?
The answer depends on how you use it.
This article explains what ISC2 CC is, what you will learn, what the exam looks like, how much it costs, how to prepare, what practical skills you should build alongside it, and whether it makes sense for your career.
What Is ISC2 Certified in Cybersecurity?
ISC2 Certified in Cybersecurity (CC) is an entry-level cybersecurity certification. It is designed to show employers that you understand fundamental security concepts such as:
- Confidentiality, integrity, and availability
- Authentication and access control
- Risk management
- Network security
- Incident response
- Business continuity and disaster recovery
- Data protection
- Security operations
- Security policies
- Security awareness
ISC2 specifically describes CC as a certification for newcomers. You do not need previous cybersecurity work experience to earn it. This certification alone will not make you a penetration tester, SOC analyst, cloud security engineer, or security architect. However, it can give you a structured foundation and help you demonstrate that foundation to employers.
Who Should Consider the ISC2 CC?
The certification can make sense for several types of people.
- IT professionals moving into cybersecurity
- Students and recent graduates
- Career changers
- Beginners who are overwhelmed by cybersecurity
Domains Covered in CC Exam
The current CC exam outline covers five major domains:
Domain 1: Security Principles
This is the foundation of the CC certification. You need to understand the basic ideas behind information security rather than memorizing security tool names.
One of the most important concepts is the CIA triad.
Confidentiality
Only authorized people should be able to access information. For example, a company’s payroll database should not be visible to every employee.
Integrity
Information should remain accurate and should not be changed by unauthorized people. For example, if an attacker changes a customer’s bank account number in a database, data integrity has been compromised.
Availability
Systems and information must be available when authorized users need them. If ransomware takes a company’s servers offline, availability has been affected.
Practical CIA Triad in Real Life
MediCare Health Systems is a healthcare provider with an electronic health records (EHR) system. Doctors, nurses, and billing staff access patient data daily for treatments, payments, and scheduling.
Domain 2: Business Continuity, Disaster Recovery and Incident Response
These three concepts are related but distinct. Security isn’t just about preventing attacks — you must also know what to do when things go wrong.
Business Continuity
How does the business keep operating during a disruption? It focuses on maintaining critical business functions. For example, employees work remotely if the office becomes unavailable.
Disaster Recovery
How do we restore systems and services after a serious disruption? It focuses on technical recovery. For example, restoring servers from backups after a ransomware attack.
Incident Response (IR)
What do we do when a security incident occurs? This focuses on handling active threats. For example, investigating a compromised employee account.
Basic IR Process includes: Detect → Analyze → Contain → Eradicate → Recover → Learn
Practical Example
Scenario: An employee reports clicking a suspicious link in a phishing email.
- Employee clicks phishing link → detects via self-report OR security tool alert
- Immediately isolate computer from network and disable employee account
- Notify Security Lead, Incident Manager, and employee’s supervisor
- Investigate: check email logs, endpoint logs, network logs, and browser history
- Reset password, enforce MFA, scan/clean or reimage device
- Restore account only after verifying no persistence
- Provide phishing training to team and review email filters
- Update IR playbook with lessons learned
- Log all actions with timestamps and submit report at earliest
Domain 3: Access Controls
Access control is one of the most practical areas of cybersecurity. The basic question is simple. Who is allowed to do what? One key concept is the principle of least privilege.
A user should receive only the access needed to perform their job. For example, a junior developer might need access to development servers but have no reason to access the company’s payroll system.
Other concepts include:
- Role-based access control (RBAC)
- Mandatory access control (MAC)
- Discretionary access control (DAC)
- Segregation of duties
- Physical access controls
- Monitoring and authorization
ISC2’s current CC outline explicitly includes physical controls such as badges, gates, CCTV, alarms, and logs as well as logical access controls such as least privilege, RBAC, DAC, and MAC.
Practical Exercise: Try Linux Permissions
If you have a Linux machine, create a test file:
You should see permissions similar to:
This means the owner can read and write the file, while other users do not have access. You have now applied an access-control concept in the real world. That is more valuable than simply memorizing the definition of least privilege.
Domain 4: Network Security
This is one of the largest parts of the CC exam. You need to understand basic networking before you can understand network security.
Important topics include:
- OSI model
- TCP/IP
- IPv4 and IPv6
- Ports
- Applications
- Wi-Fi
- Network threats
- IDS and IPS
- Firewalls
- Network segmentation
- VLANs
- VPNs
- DMZs
- Cloud networking
- SaaS, PaaS and IaaS
ISC2 also includes threats such as DDoS attacks, viruses, worms, Trojans, man-in-the-middle attacks, and other network threats in this domain.
Practical Exercise: Explore Your Own Network
On Linux or macOS, try:
or
Then inspect network connectivity with:
For real life knowledge, do not just run the commands. Look at the output and ask:
- What is my IP address?
- What ports are listening?
- What protocol is being used?
- Which devices can communicate with each other?
That is how theoretical networking becomes practical cybersecurity knowledge.
Domain 5: Security Operations
Security operations are the day-to-day activities used to protect systems and information.
This domain includes:
- Encryption
- Hashing
- Data classification
- Data retention
- Data destruction
- Logging
- Monitoring
- System hardening
- Patch management
- Password policies
- Acceptable use policies
- BYOD policies
- Change management
- Security awareness
ISC2’s current outline explicitly includes these areas.
Practical Examples
Encryption vs Hashing
- Encryption = two-way (encrypt → decrypt) — authorized parties can reverse it
- Hashing = one-way (fixed-length output) — cannot be reversed
- Encryption goal = confidentiality (keep data private during transmission/storage)
- Hashing goal = integrity (verify data hasn’t changed, e.g., password storage)
Exam tip: Don’t just memorize definitions. Ask why and what security goal each serves
System Hardening: A Good Practical Learning
System hardening means reducing unnecessary risk in a system. For a Linux server, a basic hardening checklist might include:
- Remove unnecessary services
- Apply security updates
- Disable unused accounts
- Use strong authentication
- Limit administrative access
- Configure a firewall
- Enable logging
- Review file permissions
- Monitor security events
- Maintain backups
This is one of the best areas to practice because you can build a small lab at home. Install a virtual machine using VirtualBox, VMware, or another hypervisor. Create a Linux VM. Then harden it. You will learn far more by doing this than by reading ten pages about system security.
Exam’s Basic Information
Exam Difficulty
- Entry-level cert, but preparation is required
- Format: CAT (Computerized Adaptive Testing)
- Length: 2 hours, 100–125 questions
- Passing score: 700 / 1000
- Question types: Multiple-choice + advanced items
- Center: Pearson VUE testing centers
Tip: Learn concepts first, then practice questions. Don’t assume entry-level = easy. Beginners need solid study.
Exam Cost
- Standard price: US$199 (varies by location/currency/taxes)
Always check ISC2’s pricing page for fees change.
One Important 2026 Update: The CC Exam Is Changing
ISC2 currently states that the CC exam will move to a new exam outline effective September 1, 2026.
The upcoming outline also incorporates foundational AI security concepts across the five CC domains. ISC2’s published material discusses areas such as AI-related confidentiality and integrity concerns, model poisoning, AI governance, AI-assisted incident detection, model drift, AI service accounts, AI-powered detection, and data leakage through public AI tools.
That is an important change because cybersecurity professionals increasingly need to understand how AI affects security.
Summary
The ISC2 CC certification is a sensible entry point for beginners — no years of experience or advanced skills required. Start with the fundamentals: security principles, access control, networking, incident response, and security operations.
But remember: CC is the starting line, not the finish line. Study for the exam, but also build hands-on projects — a Linux lab, network security exercises, log analysis, and incident response drills. A candidate with both the certification and practical projects is far stronger than one with just the exam pass. That’s the real value of an entry-level cert.