ISC2 CC: Identity and Access Management (IAM) Concepts
The provider lists this domain at 20% of the exam.
In plain English
Who is allowed to do what. This covers how accounts are created, reviewed and removed, and the principles that keep access as small as the job needs.
What the provider lists under it
- Identity lifecycle: role definition, provisioning, review, deprovisioning
- Logical access controls: least privilege, separation of duties, access control models
Terms worth knowing
- Least privilege: Give every person and system only the access they need to do their job, and nothing more.
- Multi-factor authentication (MFA): Proving who you are with two or more different kinds of evidence.
- Zero trust: A security approach that never assumes a request is safe just because it comes from inside the network.
Quick answers
How much of the ISC2 CC exam is Identity and Access Management (IAM) Concepts?
The provider lists it at 20% of the exam, according to the ISC2 CC exam outline (effective 1 September 2026).
What topics are in Identity and Access Management (IAM) Concepts?
Identity lifecycle: role definition, provisioning, review, deprovisioning; Logical access controls: least privilege, separation of duties, access control models.
The other ISC2 CC domains
- Security Principles (24% of the exam)
- Security Governance (17.3% of the exam)
- Networking and Cloud Security Concepts (21.3% of the exam)
- Security Operations and Incident Response (17.3% of the exam)
Test yourself
Full-length ISC2 CC practice tests with an explanation for every answer option.
Browse the ISC2 CC practice testsAll domainsDomain names, weights and topic lists come from the ISC2 CC exam outline (effective 1 September 2026), checked 2 November 2026. Providers change their outlines, so confirm the current version before you book. The plain-English explanations are ours, not the provider’s. Not affiliated with, endorsed by or sponsored by any certification vendor or exam body. Certification names, exam codes and product names are trademarks of their respective owners and are used only to identify the exam a practice product prepares for. Our questions are original and are not actual exam questions.