ISC2 CC exam domains explained

Every question and every answer is checked twice before you see it.

The ISC2 Certified in Cybersecurity (CC) exam is split into 5 domains. Here is what each one covers, how much of the exam the provider says it is worth, and where to practise it.

• Security Principles (24% of the exam)
  The foundation. What security is trying to protect (confidentiality, integrity, availability), how risk is handled, and the kinds of controls used to reduce it.
• Security Governance (17.3% of the exam)
  How an organisation organises security as a management job: rules, planning for disruption, teaching people to spot threats such as phishing, and measuring whether it works.
• Identity and Access Management (IAM) Concepts (20% of the exam)
  Who is allowed to do what. This covers how accounts are created, reviewed and removed, and the principles that keep access as small as the job needs.
• Networking and Cloud Security Concepts (21.3% of the exam)
  How networks and cloud services are protected: splitting a network into zones, layering defences, trusting nothing by default, and knowing which security jobs belong to you or to the cloud provider.
• Security Operations and Incident Response (17.3% of the exam)
  The day-to-day work: protecting data, watching for trouble, responding when something happens, and testing that defences hold.

Domain names, weights and topic lists come from the ISC2 CC exam outline (effective 1 September 2026), checked 2 November 2026. Providers change their outlines, so confirm the current version before you book. The plain-English explanations are ours, not the provider’s. Not affiliated with, endorsed by or sponsored by any certification vendor or exam body. Certification names, exam codes and product names are trademarks of their respective owners and are used only to identify the exam a practice product prepares for. Our questions are original and are not actual exam questions.