On September 1, 2026, ISC2 rolled out the first major content update to its entry-level Certified in Cybersecurity (CC) exam since the credential launched in August 2022. The exam still has five domains, but governance now stands on its own, and foundational AI concepts run through the whole outline. If your longer-term goal is the CISSP, this update is worth a look — it is a preview of where ISC2 is steering its entire certification ladder.
What changed in the CC exam?
The headline change is structural. Governance and risk topics, previously scattered across other areas, are now a dedicated Security Governance domain worth 17.3% of the exam. The rest of the outline was rebalanced around it: identity and access management and the combined networking-and-cloud domain both expanded, while the older business-continuity grouping was folded into a broader security operations and incident response domain.
The bigger theme is modernization. ISC2 integrated foundational AI topics throughout the outline, so candidates are now expected to identify AI assets, recognize automated threats, and understand the basics of governing emerging technology. New content areas include zero trust architecture, cloud security, threat intelligence, identity lifecycle management, and quantum-resistant cryptography — topics that did not exist in the 2022 version in any meaningful way.
What did not change is the format. The CC is still 100 questions in two hours, still scored on a 700-out-of-1000 scale, and still priced at $199 with a $50 annual maintenance fee once you certify.
Why does a CC change matter for CISSP candidates?
The CC is ISC2’s on-ramp. It is the credential many people earn first, years before they have the five years of experience the CISSP requires. ISC2 tends to keep its ladder internally consistent, so the emphasis you see at the entry level usually signals what is coming at the senior level.
Two signals stand out. First, governance is being promoted, not treated as an afterthought — the same governance-and-risk judgment the CISSP has always tested. Second, AI is now baseline knowledge. ISC2 is telling candidates that identifying AI risk and understanding automated threats is foundational, not specialist. A CISSP candidate reading the tea leaves should expect both themes to deepen whenever the CISSP itself is next refreshed.
Is the CISSP exam changing too?
Not yet. The CISSP was last refreshed on April 15, 2024, and ISC2 has not announced a new exam outline for it. The 2026 updates apply to the CC and to the CCSP (whose new outline took effect August 1, 2026), not the CISSP.
That said, ISC2 has clearly been tightening and modernizing across the board. In April 2026 it also cut several credentials from the CISSP experience waiver list, removing the one-year waiver for holders of the CEH, CISA, CRISC, and OSCP/OSCE. Between that change and the CC refresh, the direction is consistent: more emphasis on direct security experience, governance, and emerging-technology risk. If you want the current CISSP format while you plan, our CISSP CAT exam format guide covers exactly how today’s exam is scored.
What happened to the free CC program?
It ended. ISC2’s “One Million Certified in Cybersecurity” initiative offered the CC training and exam for free, but the organization closed new enrollment on May 20, 2026. By then more than a million people had signed up, over 570,000 had worked through the course, and more than 65,000 had earned the CC. With the free program concluded, the CC is now a standard paid exam in the ISC2 catalog like any other.
If you are weighing where the CC sits relative to the senior credential, our CISSP vs. CC comparison breaks down how the two differ in level, cost, and career fit.
Does earning the CC count toward the CISSP?
Not directly. Holding the CC does not waive any part of the CISSP’s five-year experience requirement, and it never appeared on the waiver list. What the CC does is build the foundational vocabulary and concepts — now including AI and zero trust — that make the CISSP’s eight domains far less intimidating when you get there. Think of it as groundwork, not a shortcut.
When do the CC changes take effect?
They are already live. Any CC exam sat on or after September 1, 2026 uses the updated outline. If you registered under the old outline but test on or after that date, you will see the new version, so anyone preparing right now should study against the current five-domain structure with its new Security Governance domain.
Source: ISC2, “What’s New for Entry-Level Cybersecurity” (updated CC exam outline) and the ISC2 CC certification exam outline. Figures reflect ISC2 published materials as of September 2026.
Tara Kohl is a 20-year IT veteran whose career has centered on information security and risk management. She holds the CISSP and CISM along with a range of additional certifications, and she's spent most of those years consulting for major aerospace firms and government contractors, where security and compliance demands sit at the top of the priority list.