ISC2 CC Study Plan: A 4 to 8 Week Schedule for 2026

A workable ISC2 Certified in Cybersecurity (CC) study plan runs four to six weeks at roughly 10 hours per week, split across the five exam domains in proportion to their weight, and built on active practice rather than rereading. Below you will find three ready-to-use schedules (4, 6 and 8 weeks), the domain-by-domain priorities, the study methods that hold up, and what to do after you pass.

TL;DR

• Plan on about 50 to 55 hours in total, spread over 4 to 6 weeks, according to ISC2’s own study strategy guidance. Stretch to 8 weeks if you are new to IT.
• Weight your time by domain: Security Principles is the largest at 24%, and the other four range from 17.3% to 21.3%.
• Active study beats passive reading: write your own study guides, make your own practice questions, and explain concepts aloud.
• The free exam program has closed to new enrollments. The exam now costs U.S. $199, with a $50 annual maintenance fee after you pass.
• Passing is not the last step: you must complete the certification application within nine months of your exam date.

Table of Contents

• What the CC exam asks of you
• How long you really need
• Step 1: Set the exam date first
• Step 2: Gather your materials
• A 6-week ISC2 CC study schedule
• Domain-by-domain priorities
• Study methods that work
• What the exam costs now
• Our perspective: study for the job, not just the test
• After you pass: the steps people forget
• Where to go next
• Common mistakes to avoid
• FAQ
• Sources

What the CC exam asks of you

Before you schedule anything, know the target. The CC exam outline lists five domains with these weights:

The same outline states that the exam has 100 to 125 items, lasts two hours, and requires a scaled score of at least 700 out of 1,000 to pass. Always confirm these details on the outline itself before test day, because ISC2 updates its exams and you want the current version, not a forum post from two years ago.

Two points about those weights. First, they guide how you divide your hours, but they do not tell you the exact number of questions you will see from each domain. Second, a weak domain can sink you even if it is small. Studying broadly across all five is safer than leaning on the area you already enjoy.

How long you really need

ISC2 suggests a plan of roughly four to six weeks, with 30 to 60 minutes of study per day or about 10 hours per week, which comes to around 50 to 55 hours. The same guidance advises against packing more than five hours into a single weekend day, since retention drops when you cram.

Use your background to choose a length:

• 4 weeks: you already work in help desk, networking or systems administration, and terms like firewall, subnet and access control are familiar.
• 6 weeks: you have some IT exposure, such as a certification like A+ or military communications experience, but have never studied security formally.
• 8 weeks: you are starting from scratch, or you can only study 5 to 6 hours per week because of shift work, family or a current job.

If you are deciding where the CC fits among entry-level credentials, our guide to four first cybersecurity certifications and an 8 to 12 week plan compares the options, and the prerequisites checklist shows what to have in place before you start.

Step 1: Set the exam date first

ISC2’s advice is to work backward from your exam date and break your sessions into manageable chunks that fit your free time. A date on the calendar turns an intention into a plan.

1. Pick a date at least four weeks away and book your exam through ISC2’s process.
2. Mark every study block in your calendar as if it were an appointment.
3. Reserve the final week for review only. No new material.
4. Keep one buffer day each week for the session you will inevitably miss.

Because the free program is closed, you are now paying $199 out of pocket. That is a good reason to book a date you can keep rather than one you will have to move.

Step 2: Gather your materials

Start with free, official material. The CC self-study resources page lists recommended materials and tells you to use the exam outline as your roadmap to a targeted plan. Download the outline and treat each bullet under each domain as a checklist item you must be able to explain.

Then choose one primary course or book and stick with it. Switching resources every few days is the most common way beginners lose weeks. Add practice questions in the second half of your plan, not the first, so you are not guessing at material you have not met yet.

If you prefer a live teacher, ISC2 itself offers online instructor-led CC training delivered by an ISC2 Authorized Instructor. It is one option among several, and the right choice depends on whether you learn better with a schedule and a person to ask.

A 6-week ISC2 CC study schedule

This is the default plan, at about 9 to 10 hours per week. It front-loads the heaviest domains and leaves the last week for consolidation.

That totals roughly 55 hours, which matches the range ISC2 describes.

Compressing it to 4 weeks

If you have IT experience, combine domains: week 1 for Security Principles and Governance, week 2 for Networking and IAM, week 3 for Security Operations plus first practice tests, week 4 for review. You will need closer to 12 to 14 hours per week, so be honest about whether your schedule can handle that. Cramming is the failure mode here.

Stretching it to 8 weeks

If you are new to IT, add a foundation week at the start for networking basics (IP addressing, common protocols, the difference between a switch and a router) and another after Domain 2 to rehearse it. Keep sessions at 45 to 60 minutes on weekdays.

Domain-by-domain priorities

Domain 1: Security Principles (24%)

This is the largest domain and the one that shows up everywhere else. Master the CIA triad (confidentiality, integrity, availability) and the principle of least privilege. Practitioners note that these ideas are woven through scenarios in all five domains, so time spent here pays back in every other week. Also learn the basics of risk management and the ISC2 Code of Ethics.

Domain 2: Networking and Cloud Security Concepts (21.3%)

Expect to explain how traffic moves and where controls sit. Understand what a firewall actually does in a network, how segmentation limits damage, and the shared responsibility idea in cloud services. If networking is new to you, build a small home lab or use a virtual one rather than only reading. Our networking in IT guide and the cloud security skills guide for beginners cover the groundwork.

Domain 3: Identity and Access Management Concepts (20%)

Learn the difference between identification, authentication and authorization, the factors of authentication, and how access control models differ. Questions tend to give you a situation and ask which control fits, so practice choosing, not memorizing.

Domain 4: Security Governance (17.3%)

This domain feels dry, and many technical candidates underprepare for it. Know the relationship between laws, regulations, policies, standards and procedures, and who is responsible for each. A table you build yourself is the best study tool here.

Domain 5: Security Operations and Incident Response (17.3%)

Study the stages of incident response, what logging and monitoring are for, data handling, and security awareness training. Walk through a made-up incident, such as a phishing email that leads to a compromised account, and write down what happens at each stage and who does what.

Study methods that work

ISC2’s own guidance is clear that active learning outperforms passive reading. In practice that means:

• Build your own study guide for each topic. The act of condensing a chapter into a page shows you what you do not understand.
• Write practice questions from the exam outline. Turn each outline bullet into a question, then answer it a few days later.
• Teach the concept. Explain it to a friend, a spouse or a rubber duck. If you stall, you have found a gap.
• Space your reviews. Revisit each domain briefly the week after you finish it and again in the final week.
• Track scores by domain. An overall percentage hides the one area that will fail you.

For general technique that applies to any certification, see our guide on how to study for IT certification exams.

Using practice tests well

Practice tests are for diagnosis, not confidence. Take your first one around the midpoint, review every missed question, and write down why you missed it: you did not know the term, you misread the scenario, or you rushed. In the last two weeks, take timed sets of 100 or more questions to build stamina for the two-hour sitting. Be cautious with any bank that promises exact exam questions. ISC2 does not endorse that, and memorizing leaked items will not help you reason through new scenarios.

What the exam costs now

Until recently, many candidates took the exam free through the One Million Certified in Cybersecurity program. That program is now closed to new enrollments, according to ISC2, and the standard exam fee is U.S. $199. After you pass, an annual maintenance fee of U.S. $50 applies to keep the certification. Fees can change, so check ISC2’s pages before you pay.

That makes a realistic budget: $199 for the exam, the $50 yearly fee, plus whatever you spend on study materials. Veterans should check what education and training benefits they may be eligible for and ask the training provider or the VA directly, since eligibility depends on the program and the person.

Our perspective: study for the job, not just the test

We train beginners, career changers and veterans, and the pattern we see is consistent: people who only memorize for an exam struggle in their first interview, while people who can describe what they did in a lab speak with confidence. The CC is a good first credential because it covers breadth, but breadth without practice is thin.

So our advice is to pair every domain with something you can do. When you study networking, trace a packet through a virtual network. When you study access control, set up users and permissions in a Linux machine. When you study incident response, run through a tabletop scenario and write the report. That is why our programs lean on hands-on labs, live mentoring and instructors who work in the field. Our hands-on labs guide lays out role-based paths, and our Linux for cybersecurity guide is a good companion if you want a practical skill to build alongside your CC prep.

The credential gets your resume past a filter. The practice gets you through the conversation that follows. Plan for both.

— Alden

After you pass: the steps people forget

Passing the exam does not make you certified by itself. ISC2 states that all candidates must complete the certification application process within nine months of their exam date. For CC holders this is largely an administrative step, but it is mandatory, and it includes agreeing to the ISC2 Code of Ethics, which ISC2 treats as a core commitment of the profession, not a formality. Put the deadline in your calendar the day you test.

Then pay the annual maintenance fee and keep up with continuing professional education. ISC2 publishes a certification maintenance handbook describing how credits work. It is dated 2023, so check ISC2’s site for the current version.

Where to go next

The CC is an entry point, not a destination. Many people move next to a vendor-neutral credential such as CompTIA Security+, which is widely listed in entry-level job postings, or begin building toward ISC2’s more advanced certifications. Our certification roadmap shows how the pieces connect, and when you are further along, our CISSP study plan uses the same weak-domains-first logic.

If you want structured help beyond the CC, Total Cyber Academy offers instructor-led and on-demand courses. The CompTIA Security+ SY0-701 On-Demand Course is $2,499.99 as a one-time payment, and the live version is $2,999.99. Our career-focused programs, including Cybersecurity Engineer and Penetration Tester, combine labs with mentoring from working professionals. Browse the full course catalog or the program pages to see what fits your timeline.

Common mistakes to avoid

• Starting with practice tests. Without a base, you will memorize answers instead of learning concepts.
• Over-studying your favorite domain. Technical people over-index on networking and skip governance.
• Skipping the outline. The outline defines what is testable. Everything else is optional.
• Long weekend marathons. ISC2’s guidance warns against more than five hours in a single weekend sitting.
• Forgetting the post-exam application. The nine-month window is firm.

FAQ

How do I study for the ISC2 CC exam?

Start with the official exam outline, divide your time by domain weight, and study 30 to 60 minutes a day or about 10 hours a week for four to six weeks. Build your own summaries and practice questions as you go. Save full practice tests for the second half of your plan.

Is the ISC2 CC hard to pass?

It is an entry-level exam, and the concepts are foundational, but it does require a score of 700 out of 1,000 across five domains. Candidates with no IT background usually need more time, especially for networking. Consistent weekly study and domain-level score tracking make it manageable.

Is the ISC2 CC still free?

No. The free One Million Certified in Cybersecurity program is closed to new enrollments, and the exam now costs U.S. $199, with a $50 annual maintenance fee once you pass. Anyone who already holds a valid voucher should check its expiration with ISC2.

Is the ISC2 CC exam worth it?

For beginners, career changers and veterans moving into IT, it is a low-cost, recognized way to show foundational security knowledge. It works best when paired with hands-on practice and followed by a more advanced certification. It will not replace experience, but it can open doors to entry-level conversations.

Can I pass with self-study alone?

Many people do, using the free official outline and self-study resources. If you tend to stall without structure, an instructor-led class or a mentor gives you accountability and someone to answer questions as they come up.

Sources

• ISC2: Beyond the Books, Mastering Your CC Study Strategy
• ISC2: Certified in Cybersecurity Exam Outline
• ISC2: One Million Certified in Cybersecurity
• ISC2: CC Self-Study Tools and Resources
• ISC2: CC Online Instructor-Led Training
• ISC2: Certification Endorsement and Application Process
• ISC2: What To Do After Your Exam
• ISC2: Certification Maintenance Handbook (2023)

Recommended

• CISSP Study Plan: 6 Weeks to 6 Months, Weak Domains First
• Prepare for CCSP in 12 Weeks With the Official ISC2 Study Guide