ISC2 Certified in Cybersecurity (CC): Cost, Exam Format, and the Free-Exam Reality

For several years the pitch for this credential was simple: the exam is free, so there is nothing stopping you from trying. That pitch changed this year, and the honest version of the story is what this page covers, along with the fee that was never actually free even when the exam voucher was.

Who this cert is actually for

Certified in Cybersecurity is built for people with no cybersecurity background at all: career changers, recent graduates, or anyone testing whether the field is a fit before committing money or years to it. ISC2 designed it as a genuine zero-prerequisite entry point, unlike almost every other credential this site covers, and it assumes no prior IT experience rather than just no formal degree. If you already hold CompTIA Security+ or CompTIA A+, CC will feel like a review rather than new ground.

Skip it if you already have any hands-on IT or help desk experience; Security+ or Network+ signals more to an employer at that point, since CC is explicitly the credential for people with zero background. Skip it too if you are weighing it against ISC2 CISSP as a shortcut. CC and CISSP share a publisher but not a purpose. CC gets you in the door; CISSP is a five-year-experience credential for people already well into a security career. One does not substitute for the other.

What it costs all-in, and the free-exam program’s real status

Here is the fee reality that matters more than any other fact on this page. ISC2 ran a program called One Million Certified in Cybersecurity that covered both a free training course and a free exam voucher for anyone who signed up. As of May 20, 2026, ISC2 closed that program to new enrollment, stating it had surpassed its one-million-enrollment goal. Candidates who already hold an unexpired voucher code from the program can still sit the exam at no charge through December 31, 2026. Anyone enrolling now pays the standard exam price of $199 in the Americas, Asia Pacific, the Middle East and Africa; ISC2 lists GBP 161.19 for the United Kingdom and EUR 191.04 for its EMEA pricing, with tax set by exam location. A failed attempt means registering again at the full price after 30 test-free days, with at most four attempts in 12 months. CC is ISC2’s entry-level exam and should not be confused with its cloud credential: the CCSP exam costs $599 and requires five years of experience; see ISC2 CCSP for that breakdown.

Even during the free-voucher years, the certification itself was never free to hold. Once you are certified, ISC2 requires a $50 Annual Maintenance Fee (AMF) every year to keep the certification active, due on your certification anniversary, regardless of whether your exam attempt cost $0 or $199. That fee is not optional and is not a one-time charge; over a nine-year span (three renewal cycles) it is $450 in AMF alone, on top of whatever the exam itself cost you. A candidate who tells you CC is “free” is describing the entry cost, not the ongoing one.

Compare that all-in figure honestly against other entry-level paths on the ROI Index: CC at $199 plus $450 in AMF over nine years lands in a different place than a CompTIA credential’s flat CE-fee renewal, because ISC2’s AMF is charged annually, not per renewal cycle. Prep can cost nothing: ISC2’s exam outline is the free syllabus, and an optional third-party course or practice-question bank runs up to about $50, so a first attempt lands between $199 and $249 all-in.

The exam itself

The CC exam runs 2 hours and delivers 100 to 125 questions using computerized adaptive testing (CAT), mixing multiple-choice with advanced interactive item types. A passing score is 700 out of a possible 1,000 points. A new exam outline took effect September 1, 2026, and it reorganized the domains rather than just reweighting them. The five current domains are Security Principles (24 percent, the largest single slice), Networking and Cloud Security Concepts (21.3 percent), Identity and Access Management (IAM) Concepts (20 percent), Security Governance (17.3 percent), and Security Operations and Incident Response (17.3 percent). Business continuity and disaster recovery no longer stand as their own domain, cloud security now sits alongside networking, and governance is new as a named domain, so study material written for the pre-September 2026 outline will be organized differently from the exam you sit. ISC2 does not publish a pass rate for CC or any of its other certifications.

Renewal math over 9 years

CC is valid for three years, so nine years covers three renewal cycles. Each cycle you need 45 CPE (continuing professional education) credits, with ISC2 suggesting a pace of about 15 per year so the requirement never piles up at the deadline. All 45 must be Group A (domain-related) credits, since ISC2 does not accept Group B professional-development credits from CC holders. That is a lighter CPE load than ISC2’s higher-tier certifications carry.

The AMF is the part that does not go away no matter how you handle CPEs: $50 a year, every year, for as long as you hold the certification, which is $150 per three-year cycle and $450 across nine years. Unlike CompTIA’s model, where a paid renewal course can fold CE requirements and fees into one purchase, ISC2’s AMF is a fixed annual membership charge separate from CPE activity. There is no version of holding this certification for nine years that costs $0; budget the full $450 in AMF as the honest floor, on top of whatever the initial exam cost you.

Nine-year cost of ownership: about $649 at the standard $199 exam price, or $450 in AMF alone for anyone who sat the exam on a pre-2026 free voucher, the exam plus $450 in Annual Maintenance Fees over nine years. There is no free path out: the $50-a-year AMF bills whether or not you gather CPEs, and no second ISC2 credential reduces it. A candidate who calls CC “free” is quoting the entry cost, not this one. Certification renewal costs explained compares it to CompTIA’s flat CE-fee model.

What it does for the occupation you are entering

CC maps to the information security analyst occupation (BLS code 15-1212), the same broad category Security+ and CySA+ target. The panel on this page shows the current national median wage and headcount for that occupation; read it as a picture of where the field can lead, not a wage this specific entry-level credential guarantees on its own. The Bureau of Labor Statistics projects continued strong growth in the broader information security analyst occupation, which is the real draw for someone testing the field. What CC concretely buys a total newcomer is a resume line that signals baseline security literacy and genuine intent, useful for landing a first help desk or junior analyst role where you can build the actual experience that later credentials and raises depend on.

Common mistakes

Believing the free-exam window is still open. The One Million Certified in Cybersecurity program stopped accepting new enrollees on May 20, 2026. If you do not already hold a voucher code from before that date, budget the standard $199, not $0.

Forgetting the AMF exists. Because the exam itself was marketed as free for years, plenty of newly certified holders are surprised by the first $50 invoice. Set a calendar reminder for your certification anniversary before it becomes a lapsed-certification problem instead of a routine bill.

Stopping here when you have real IT experience already. CC is a floor, not a ceiling. If you already troubleshoot networks or support end users professionally, Security+ or Network+ will do more for your resume than CC alone, since employers reading CC on an experienced candidate’s resume may read it as underqualification rather than initiative.