Study Weights, Not Chapters: A 60-Day ISC2 CC Study Plan

The ISC2 Certified in Cybersecurity (CC) exam has 100-125 items, a 2 hour limit and a passing score of 700 out of 1000. To prepare in 60 days, give each of its five domains study time in proportion to its weight, using the outline effective 1 September 2026.

What changed in the ISC2 CC exam outline for 2026?

ISC2 replaced the original outline with a new one, effective 1 September 2026, and it changes both domain names and domain weights. According to ISC2's own announcement, this is the first major content update since the certification launched in August 2022.

If you are studying now, you are studying for the new outline. That matters because many older guides, videos and flashcard sets still describe the 2025 version, and a plan built on the old weights would send your hours to the wrong places.

Here is how the two outlines compare, using ISC2's published figures:

Three shifts stand out. Governance now has its own domain, worth 17.3%. Cloud security is now named in the networking domain and has dedicated coverage. Incident response moved into the final domain, which now also covers threat intelligence and security testing.

ISC2 also states that foundational AI concepts are woven through all five domains. You do not need a separate AI study track. You do need to expect questions that apply the usual ideas, such as data integrity, access control and incident response, to AI systems.

You can read every sub-topic in the official ISC2 CC exam outline. Keep it open next to this plan, because the plan refers to its numbered objectives, such as 3.2 or 4.3.

How should you split 60 days across five domains?

Give each domain a share of your study days that matches its weight, then reserve a few days at each end for setup and review. With 2 setup days, 51 domain days and 7 review days, the split below follows the 2026 weights closely.

The arithmetic is simple. Of the 51 domain days, Security Principles at 24% earns about 12 days, Networking and Cloud at 21.3% earns 11, IAM at 20% earns 10, and Security Governance and Security Operations, both at 17.3%, earn 9 each. Those add up to 51.

Why not simply study in the order of the outline and spend equal time everywhere? Because the exam does not weigh the domains equally. Equal time over-serves the smaller domains and under-serves the larger ones. Proportional time is also easy to defend: if a topic is worth a quarter of the exam, it deserves a quarter of your attention.

How much time per day does this need? ISC2 does not set a study-hours figure, so this plan is built on a modest habit rather than a promise: about 60 to 90 minutes on weekdays and a longer block on one weekend day. If you are a full-time worker, that routine is realistic. If you can only manage 30 minutes, stretch the plan rather than skipping domains.

Before the day-by-day detail, a note on the method behind each block. Every domain block follows the same four steps:

• Read first. Go through the outline objectives for that domain and write each one as a question in your own words.
• Learn once, then recall. Study the material, then close it and write what you remember before checking.
• Practise in the domain. Do a short set of questions in that domain only, then review every wrong answer.
• Close with a one page summary. If you cannot summarise a domain on one page, you have found your next study session.

What do you do on days 1 to 14: setup and Security Principles?

Spend days 1 and 2 on setup, then days 3 to 14 on Security Principles. This is the longest single block because it carries the largest weight, 24%, and because every later domain builds on its vocabulary.

Days 1 and 2: setup and baseline

Start by deciding how you will study. ISC2 sells online self-paced and instructor-led training, and it also sells bundles that include the exam. Its page lists 90-day and 180-day access options for self-paced training, 180 days of access for instructor-led materials, and a 365-day window to sit the exam on the 90-day bundle. Peace of Mind Protection gives two exam attempts, with 180 days from purchase to sit both. Check the ISC2 CC certification page on isc2.org for current terms before you buy anything.

Then do three small tasks. Print or save the exam outline. Make a one page calendar with the blocks from the table above. Take a short baseline quiz and note your score without worrying about it. The baseline is not a verdict. It tells you which domain will need the most repetition.

If you are new to the field, a broad orientation helps before you start. This cybersecurity certification roadmap shows where CC sits among the entry level options, which helps you judge whether it is the right first step.

Days 3 to 14: Security Principles (24%)

The outline splits this domain into five objectives: cybersecurity concepts, risk management concepts, governance concepts, cybersecurity controls, and professional and ethical conduct. Allocate them across the 12 days as follows.

• Days 3 to 5, objective 1.1: confidentiality, integrity, availability, Authentication, Authorization and Accounting (AAA), non-repudiation and privacy. Learn each term well enough to explain it to a colleague without notes.
• Days 6 to 8, objective 1.2: the risk management lifecycle and its processes. Draw the cycle from memory and label each stage.
• Days 9 to 10, objective 1.3: regulations and laws, frameworks and guidelines, and policies, standards and procedures. The outline names ISO and the Center for Internet Security as examples of standards.
• Days 11 to 12, objective 1.4: technical, administrative and physical controls. Sort ten everyday controls, such as a firewall, a security policy and a door lock, into the three types.
• Days 13 to 14, objective 1.5: the professional code of conduct, due care, due diligence and the ISC2 Code of Ethics. Finish with a 20 question domain set.

One exam habit pays off here. Entry level questions often test the difference between two similar terms, such as a policy versus a standard, or a control type versus a control function. Keep a running list of confusable pairs and review it every few days.

How do you study Governance and IAM on days 15 to 33?

Governance takes days 15 to 23 and Identity and Access Management takes days 24 to 33. They sit together because both are about who is allowed to do what, and under which rules.

Days 15 to 23: Security Governance (17.3%)

This domain is new in the 2026 outline, so older material will not cover it well. It replaces the old business continuity and disaster recovery domain, although those topics remain inside it.

• Days 15 to 17, objective 2.1: planning Governance, Risk and Compliance (GRC), including its purpose, importance, frameworks and tools. Write one sentence for each of the three letters.
• Days 18 to 19, objective 2.2: redundancy, meaning Business Continuity (BC) and Disaster Recovery (DR). Learn what each plan is for and who uses it.
• Days 20 to 21, objective 2.3: security awareness, organisational culture, social engineering, password protection and phishing. These are plain topics, so it is easy to underestimate them. Do not.
• Days 22 to 23, objective 2.4: measuring cybersecurity effectiveness with key metrics, Key Risk Indicators (KRIs), dashboards, scorecards and reports.

The study tip for governance is to tie every idea to a person and a decision. Who writes the policy, who follows it, who measures whether it works? Governance questions are easier when you picture the workplace behind them. The same habit helps with other foundation exams, as described in this Microsoft SC-900 guide, which covers security, compliance and identity fundamentals from a different vendor angle.

Days 24 to 33: IAM Concepts (20%)

IAM has two objectives, so you have time to go deep on each. Objective 3.1 is identity lifecycle management: roles definition, provisioning, review and deprovisioning, with frameworks and tools. Objective 3.2 is logical access control: the Principle of Least Privilege (PoLP), Separation of Duties (SoD) and access control models.

• Days 24 to 27, objective 3.1: follow one imaginary employee from their first day to their last. Note what access they receive, who approves it, when it is reviewed and how it is removed.
• Days 28 to 31, objective 3.2: compare the access control models side by side in a table. Write one real example for each, and note which model suits which setting.
• Days 32 to 33: a 25 question IAM set, followed by a written summary.

The 2026 outline treats identity as a central security layer, with broader coverage than the old access controls domain. Expect questions that ask what should happen when someone changes role or leaves the company, not only what a model is called.

How do you cover Networking, Cloud, and Security Operations on days 34 to 53?

Networking and Cloud takes days 34 to 44, and Security Operations and Incident Response takes days 45 to 53. These two blocks are the most technical, so keep the daily sessions short and frequent rather than long and rare.

Days 34 to 44: Networking and Cloud Security Concepts (21.3%)

This is the second largest domain, and it has three objectives: network security, network security architecture and cloud security.

• Days 34 to 37, objective 4.1: the OSI and TCP/IP models, IPv4 and IPv6, Virtual Private Networks (VPNs), firewalls, ports, wireless such as Wi-Fi and Bluetooth, and embedded systems such as Industrial Control Systems (ICS) and the Internet of Things (IoT). Memorise the layers of both models and a handful of common ports.
• Days 38 to 40, objective 4.2: network segmentation, including firewall zones, Virtual Local Area Networks (VLANs) and micro-segmentation, plus defense in depth and Zero Trust (ZT). Sketch a simple office network and mark where each control sits.
• Days 41 to 43, objective 4.3: the characteristics of cloud computing, service models, deployment models and the shared responsibility model. Learn the five characteristics named in the outline: broad network access, rapid elasticity, measured service, on-demand self-service and resource pooling.
• Day 44: a 30 question set across all three objectives.

If networking is new to you, do not try to learn it all at once. Learn the models first, then ports, then devices. The outline asks for concepts, not configuration, so you do not need command line skills for this exam.

A common stumble in cloud questions is the shared responsibility model. Practise stating, for each service model, what the provider secures and what the customer secures. If you can do that from memory, most cloud questions become straightforward.

Days 45 to 53: Security Operations and Incident Response (17.3%)

The final domain is the most changed one. The old data security and system hardening topics remain, and ISC2 adds threat intelligence, event triage, incident response planning, asset lifecycle and security testing.

• Days 45 to 46, objective 5.1: data handling (classification, labeling, masking and sanitization) and encryption, including symmetric, asymmetric, hashing and quantum resistant cryptography.
• Days 47 to 48, objective 5.2: logging and monitoring, security event triage, threat actors and their motivations, cyber threat intelligence and threat frameworks.
• Days 49 to 50, objective 5.3: the Incident Response Plan (IRP) and incident response exercises such as testing and tabletop sessions.
• Day 51, objective 5.4: asset lifecycle management, including end of life software and devices, plus configuration and change management.
• Days 52 to 53, objective 5.5: security readiness testing (red, blue and purple teaming), application testing such as vulnerability scanning, static analysis, dynamic analysis and threat modelling, and physical penetration testing such as phishing, tailgating and impersonation.

For incident response, learn the order of events and who does what at each step. Then turn it into a story: an alert fires, someone triages it, a plan is followed, and the team learns from the exercise. A story is easier to recall under time pressure than a list.

What should the final seven days look like?

Days 54 to 60 are for mixed practice, not new content. By now you have touched every domain, so the job is to find and repair weak spots, and to rehearse the exam experience.

• Days 54 and 55: take a mixed set of about 50 questions each day, drawn from all five domains. Sort every miss by domain and by cause: did you not know it, mix up two terms, or misread the question?
• Day 56: revisit your weakest domain from the one page summaries. Use the weights as a guide to where the largest losses are likely to be.
• Day 57: rebuild your list of confusable pairs and quiz yourself from it.
• Day 58: a timed mixed session of about two hours, to practise concentration across the full exam length.
• Day 59: light review only. Skim the summaries and stop early.
• Day 60: rest, check your booking details and identification, and sleep.

Practice questions are most useful when you review them well. Reading why a wrong option is wrong teaches more than counting how many you got right. You can find free practice material on the ISC2 CC sample questions page, which is a handy way to check your pace and your weak areas, though questions in any set are practice, not a preview of what you will see.

If you want general advice on how beginners can approach exams from other vendors with the same discipline, this set of CompTIA beginner study tips covers habits that carry across certifications.

How does the adaptive format and booking affect your plan?

The ISC2 CC exam uses Computerized Adaptive Testing for all exams, and ISC2 lists a length of 2 hours and 100 to 125 items. In plain terms, the exam adjusts as you answer, and the number of items you see can vary within that range.

For your plan, two points follow. First, you cannot count on skipping a weak domain, because every domain is tested and the weights are averages. Second, pacing matters: with up to 125 items in 120 minutes, you have a little under a minute per item at the top of the range. Practise reading questions quickly and carefully, because careful reading is most of the work on a fundamentals exam.

Booking is done through ISC2 and Pearson, and the ISC2 page lists a Pearson testing centre as the delivery location. Choose your date when you set up your plan, ideally a few days after day 60 so you have a small buffer. A real date makes the 60 days feel real.

Cost is the other planning item. ISC2 exam pricing lists the ISC2 CC exam at US $199 for standard registration in the Americas and Asia Pacific, with local currency and taxes set at registration, and ISC2 sells training bundles on top. Compare what you need, because the exam alone is enough for a candidate who already has solid study material. If you are an employer-sponsored learner, ask what your company already provides.

What if you have 30 days, or 90?

Keep the same weights and change the length of each block. The method scales: multiply or divide the days per domain by the same factor, and keep the review week in some form.

• 30 days: compress to roughly 25 domain days (6, 4, 5, 5 and 5 across the five domains in order), 2 setup days and 3 review days. This only works if you can study every day.
• 90 days: double the setup to a week, give each domain 1.5 times the days in the 60-day plan, and take two full review weeks. This suits people with a full workload.

Whichever length you choose, hold two principles. First, domain time follows domain weight. Second, every domain ends with a written summary and a short question set, so you always know where you stand.

It is also worth repeating that no study plan can promise a result. The plan raises your odds by putting your hours in the right places, and your own consistency does the rest. Whether you pass on the first attempt or not, the preparation is useful learning for entry level work.

What happens after you take the exam, and where does CC lead next?

Once you have your result, the next step is to turn the credential into a story that employers can see. ISC2 describes the CC as a first step for IT professionals, career changers and recent graduates, and it states there is no work experience requirement. ISC2 also notes that the certification is ANAB accredited under ISO/IEC Standard 17024 and approved under U.S. DoDM 8140.03.

ISC2 further states that its members report 35% higher salaries than non-members. Treat that as ISC2's own claim about its membership rather than a promise for any single career, and weigh it alongside the salary surveys for your own region and role.

Many candidates then move toward ISC2 certifications such as the SSCP or CISSP, or toward other vendors' entry level exams. If you are still choosing, compare the options in your roadmap and match them to the job titles you want. The habits you build over these 60 days, namely weight-based planning, written summaries and careful review, carry over to every later exam.

Plan your 60 days, book your slot and start with the setup days. Check ISC2's current pages before you pay, since fees, policies and the outline can change.

Frequently Asked Questions

Is 60 days enough to prepare for the ISC2 CC exam?

For many beginners it is a realistic window if you study about an hour on most days. ISC2 requires no prior experience, and the plan above paces all five domains. Longer or shorter plans work if you keep the weights.

What are the 2026 CC exam domain weights?

The 2026 outline, effective 1 September 2026, weighs Security Principles at 24%, Security Governance at 17.3%, IAM Concepts at 20%, Networking and Cloud Security Concepts at 21.3% and Security Operations and Incident Response at 17.3%.

How many questions are on the ISC2 CC exam and what is the pass mark?

ISC2 lists 100 to 125 items in 2 hours, using Computerized Adaptive Testing. The passing grade is 700 out of 1000 points. Items are multiple choice and advanced item types, so read each question carefully.

Do old ISC2 CC study guides still work after the 2026 outline?

They help with shared topics such as the CIA triad and access control, but they miss the new governance domain, cloud coverage and expanded incident response. Check any older guide against the current ISC2 outline before relying on it.

Do I need work experience or a technical degree for CC?

No. ISC2 states the Certified in Cybersecurity is entry level and that no work experience is required. It is aimed at IT professionals, career changers and recent graduates, so a degree is not a prerequisite.