ISC2 CC: Security Principles
The provider lists this domain at 24% of the exam.
In plain English
The foundation. What security is trying to protect (confidentiality, integrity, availability), how risk is handled, and the kinds of controls used to reduce it.
What the provider lists under it
- Core security concepts: CIA, AAA, non-repudiation, privacy
- Risk management lifecycle and processes
- Governance: laws, frameworks, policies, standards, procedures
- Technical, administrative and physical controls
- Professional conduct and the ISC2 Code of Ethics
Terms worth knowing
- CIA triad: Three goals of information security: confidentiality, integrity and availability.
- Least privilege: Give every person and system only the access they need to do their job, and nothing more.
- Stakeholder: Anyone who can affect a project or is affected by it.
Quick answers
How much of the ISC2 CC exam is Security Principles?
The provider lists it at 24% of the exam, according to the ISC2 CC exam outline (effective 1 September 2026).
What topics are in Security Principles?
Core security concepts: CIA, AAA, non-repudiation, privacy; Risk management lifecycle and processes; Governance: laws, frameworks, policies, standards, procedures; Technical, administrative and physical controls; Professional conduct and the ISC2 Code of Ethics.
The other ISC2 CC domains
- Security Governance (17.3% of the exam)
- Identity and Access Management (IAM) Concepts (20% of the exam)
- Networking and Cloud Security Concepts (21.3% of the exam)
- Security Operations and Incident Response (17.3% of the exam)
Test yourself
Full-length ISC2 CC practice tests with an explanation for every answer option.
Browse the ISC2 CC practice testsAll domainsDomain names, weights and topic lists come from the ISC2 CC exam outline (effective 1 September 2026), checked 2 November 2026. Providers change their outlines, so confirm the current version before you book. The plain-English explanations are ours, not the provider’s. Not affiliated with, endorsed by or sponsored by any certification vendor or exam body. Certification names, exam codes and product names are trademarks of their respective owners and are used only to identify the exam a practice product prepares for. Our questions are original and are not actual exam questions.