What's on the ISC2 CC Exam? The Five Certified in Cybersecurity Domains, Weights, and Format

What are the five ISC2 CC exam domains?

Everything the CC exam measures comes from one document: ISC2's Certified in Cybersecurity Certification Exam Outline, effective September 1, 2026. It keeps the five-domain structure CC has had since it launched in August 2022, but it renames most of the domains and changes every weight. The outline gives each domain an average weight:

The last column multiplies each weight by 75, the minimum number of scored items ISC2 says a candidate must answer to get a result. The products land almost exactly on 18, 13, 15, 16 and 13, which would explain the decimals and why the published weights add up to 99.9% rather than 100%, though ISC2 does not say how it set them. The outline gives weights, not item counts per domain, and an adaptive exam can run past the minimum, so read the column as a picture of emphasis. ISC2's adaptive testing FAQ says each exam is built to the outline's domain weights whatever its length. For practice, full ISC2 CC prep planned for launch sizes each domain's question set to these weights, from 156 questions each for Security Governance and for Security Operations and Incident Response to 216 for Security Principles.

The weights also hide a difference in density. Identity and Access Management carries 20% across just two subdomains, about 10% each if the share were even. Security Operations and Incident Response spreads 17.3% across five, about 3.5% each. The outline weights domains, not subdomains, so this is only a rough guide, but it shows why the identity life cycle and logical access controls deserve more time than their count suggests.

What does each CC domain cover?

Most subdomains start with "Understand." Only three use another verb: 1.5 asks you to maintain professional and ethical conduct, 2.1 to plan governance, risk and compliance, and 2.4 to measure cybersecurity effectiveness. The verbs point to conceptual questions: knowing what a term means and which concept fits a situation. Here is each subdomain in plain words.

These are short paraphrases, so read the outline itself for the full lists. ISC2 also says it integrated foundational AI concepts into all five domains instead of adding an AI domain. Its outline page gives examples: data integrity as a defense against model poisoning in Security Principles, "model drift" as a continuity risk in Security Governance, bots and service accounts managed through the identity life cycle, and data leaking into public AI services in Security Operations and Incident Response.

How does the adaptive CC exam work?

ISC2 uses computerized adaptive testing (CAT) for every CC exam. Each candidate starts with an item well below the passing standard, and the algorithm picks each next item from your answers so far. ISC2's CAT page and the outline give these rules:

• Length: at least 100 and at most 125 items. Twenty-five are unscored pretest items that look like the others, so treat every item as scored.
• Time: up to 2 hours, and any breaks you take count toward that time.
• Item types: multiple choice and advanced item types.
• No going back: once you finalize an answer, you cannot review or change it.
• How it ends: after the first 100 items, the exam stops once your ability estimate is above or below the passing standard with 95% confidence. Otherwise it ends at 125 items or when time runs out, and your final estimate is compared with the standard.
• The time rule: if time runs out before you have answered 75 scored items and 25 pretest items, the result is an automatic fail.
• Result: pass or fail, with no numerical score on the report. The passing grade is 700 out of 1000 points, and candidates who do not pass get feedback on the domains where they struggled.
• Where and in what language: Pearson VUE test centers, in English, Chinese, Japanese, German and Spanish. Chinese exams run only in set appointment windows.

A longer exam does not mean you are failing. ISC2 explains that candidates who go past 100 items may be proficient in some domains and are getting more items to show proficiency in others. At the 125-item maximum, 2 hours works out to a little under a minute per item, and full ISC2 CC prep at launch includes a 125-question, 2-hour timed mock exam for rehearsing that pace, though a fixed mock cannot adapt the way the real exam does.

What changed from the original CC outline?

ISC2 calls the current outline the first major content update since CC launched. Between 2022 and the update, items were refreshed and the exam moved from a fixed linear form to adaptive testing, but the content still followed the original outline. ISC2's article on the update compares the two:

The biggest shift is in the second domain, which grew from 10% to 17.3% and changed its subject. ISC2's article describes the other changes:

• Governance has its own domain. Domain 2 now centers on governance, risk and compliance, security culture and awareness, and measuring the security program. Business continuity and disaster recovery remain, under redundancy.
• Incident response moved to Domain 5. That domain also adds event triage, threat actors, threat intelligence and frameworks, response exercises, the asset life cycle, and security testing from red teaming to physical penetration tests.
• Access controls became identity and access management. Least privilege and separation of duties stay, joined by the identity life cycle from role definition to deprovisioning.
• Networking added cloud. Cloud characteristics, service and deployment models and the shared responsibility model are new, along with zero trust and modern segmentation.
• Domain 1 changed its vocabulary. "Information assurance" became "cybersecurity concepts" with AAA, risk management moved to concepts and the life cycle, and due care and due diligence joined the ethics topics.
• Data security grew. Masking, sanitization and quantum-resistant cryptography are new.

If your notes, book or practice questions use the old domain names, such as Access Controls Concepts or Network Security, they were written for the original outline. Check each topic against the current outline before you rely on it. Full ISC2 CC prep planned for launch is written for the current five domains, not the original outline.

Which CC outline applies if you test in 2027?

The current outline is the one ISC2 publishes for CC in all five exam languages, and as of November 1, 2026 ISC2's outline page links no newer CC outline. For a 2027 exam date, it is the version to study. ISC2 says it updates the exam from a job task analysis conducted at regular intervals, so check the outline page again before you book.

If you are still deciding whether to book, the ISC2 CC exam cost guide covers the $199 registration fee, the $50 annual maintenance fee, and what happened to ISC2's free CC exam program.

How should you split CC study time across the five domains?

Start by splitting your hours by the weights, then adjust for your gaps. With 40 hours, a straight split gives about 10 hours to Security Principles, 7 to Security Governance, 8 to Identity and Access Management, 8 to Networking and Cloud Security Concepts, and 7 to Security Operations and Incident Response. That is an editorial starting point, not an ISC2 rule. ISC2 requires no work experience for CC and recommends basic IT knowledge, so if networking is new to you, move hours there first.

Then study the way the outline is written:

1. Learn the vocabulary of each domain until you can define it in your own words: the CIA triad and AAA, the three control types, the access control models, and the cloud service models.
2. Practice telling close concepts apart, because short scenario questions often turn on one distinction: least privilege versus separation of duties, a recovery point objective versus a recovery time objective, clearing media versus purging it, or what the customer patches in IaaS versus PaaS.
3. Read each scenario for its conditions, such as who owns the data, what has already happened, and what the organization wants to avoid, before you look at the options.

Keep the definitions in short daily reviews alongside the scenario work. For that recall layer, see how the 450 flashcards planned for full CC prep are sorted by domain.

Your first step with the CC domains

Find out where you stand before you plan the hours. The 20 free ISC2 CC practice questions are split across the five domains by their weights, explain every option and end with a breakdown by domain. Use that breakdown to choose your weak domain in the free ISC2 CC study planner, which turns your exam date and daily minutes into a dated outline.