No, not for new candidates. ISC2's One Million Certified in Cybersecurity programme, which gave away free training and a free exam, has ended. The Certified in Cybersecurity (CC) exam now costs US$199, plus a US$50 annual maintenance fee once you pass. If you received a free exam code before the programme closed and it has not expired, you can still sit the exam until 31 December 2026.
Key takeaways
- The free CC programme reached its one million goal and is closed to new sign-ups.
- The standard exam fee is now US$199, with a US$50 annual maintenance fee after you certify.
- Unexpired free exam codes can be used until 31 December 2026.
- Many free cybersecurity courses still exist, but most give a course badge, not a certification.
What is the ISC2 Certified in Cybersecurity (CC)?
CC is the entry-level certification from ISC2, the organisation behind the well-known CISSP. It needs no work experience and covers five areas: security principles, business continuity and incident response, access control, network security, and security operations. It is aimed at students and career changers who want a first security credential.
Is the ISC2 CC exam still free?
ISC2 confirms on its programme page that One Million Certified in Cybersecurity is ending because it passed its goal of enrolling more than one million people in the free course and exam. The same page says that anyone who was issued a CC exam code through the programme, and whose code has not expired, may schedule and sit the exam by 31 December 2026.
ExamCert's cost breakdown reports that the programme closed to new participants on 20 May 2026. Many older blog posts and social media lists still call CC a free certification, so check the date of anything you read.
How much does the ISC2 CC cost now?
| Item | Cost |
|---|---|
| Exam fee | US$199 |
| Annual maintenance fee | US$50 a year |
| First-year total if you self-study | About US$249 |
These figures come from Training Camp's 2026 CC guide and match Open Exam Prep's exam facts. Prices and tax vary by region. ISC2's own page confirms that after passing you complete an application and pay the US$50 annual maintenance fee to hold the certification.
To keep CC active you also need 45 continuing professional education credits over each three-year cycle.
What is the CC exam like?
The exam is taken at a Pearson VUE test centre. Open Exam Prep lists a time limit of 120 minutes for 100 to 125 questions under the outline that took effect on 1 September 2026, with a scaled pass mark of 700 out of 1000. Questions are multiple choice and focus on concepts and definitions, not hands-on configuration.
Most beginners need two to four weeks of steady study. It is noticeably easier than Security+, which is longer in content and includes performance-based questions.
How should you prepare for the CC exam?
CC rewards understanding of definitions and principles, so the best preparation is steady reading and question practice, not labs. A simple four-week plan works for most beginners.
- Week 1: security principles. Learn confidentiality, integrity and availability, risk terms, and the difference between policies, standards and procedures.
- Week 2: incident response, business continuity and disaster recovery. Know what each plan is for and the order of the steps.
- Week 3: access control and network security. Cover authentication factors, least privilege, common ports, firewalls and typical attacks.
- Week 4: security operations, then two or three timed practice exams.
ISC2 questions often ask for the best answer among several that sound correct. Read every option before choosing, and think like a manager protecting people and the organisation first, technology second. The ISC2 Code of Ethics is also examinable, so read it once carefully.
Students who already hold or are studying for Security+ usually need only a few days of review, because the content overlaps heavily.
Is the CC still worth paying for?
When it was free, CC was an easy decision. At US$199 it competes with other options. Consider it if you want an ISC2 membership early, your employer or university recommends it, or you want a gentle first exam before Security+.
If your goal is a security job, Security+ is requested far more often in job adverts, so many students now save their money for that. Our Security+ vs Network+ guide explains the path. If your budget is zero, start with courses that are still free: see our list of free cybersecurity courses with certificates.
Frequently asked questions
Can I still get a free ISC2 CC exam voucher?
Not as a new candidate. The One Million Certified in Cybersecurity programme has closed. Only people who already hold an unexpired code can use it, and only until 31 December 2026.
Is ISC2 CC easier than Security+?
Yes. CC is a shorter, concept-based entry exam with no performance-based questions. Security+ covers more material in more depth.
Do I have to pay the ISC2 annual fee?
Yes, if you want to hold the certification. After passing you pay a US$50 annual maintenance fee and earn 45 CPE credits every three years.
Sources
- One Million Certified in Cybersecurity FAQ, ISC2
- One Million Certified in Cybersecurity has concluded, ISC2
- Is ISC2 CC worth it in 2026?, ExamCert
- Official 2026 CC exam facts, Open Exam Prep
- ISC2 CC certification guide 2026, Training Camp