ISC2 Certified in Cybersecurity Eligibility

Who is eligible to take the CC exam

ISC2 Certified in Cybersecurity is an entry-level credential designed for people beginning to learn cybersecurity. There is no professional experience prerequisite, no required cybersecurity job title and no degree requirement. A candidate can register while studying, changing careers or working in another field. ISC2 does require exam candidates to be at least 16 years old and to follow the current account, identification, testing and exam-agreement rules.

Eligibility to sit for the exam is different from preparation readiness. You may be allowed to register without prior security work, but still need enough time to learn the current outline. The active CC outline took effect September 1, 2026. Before setting a date, make sure your materials cover its five domains: Security Principles; Security Governance; Identity and Access Management Concepts; Networking and Cloud Security Concepts; and Security Operations and Incident Response.

Experience is not an application condition

CC does not require a candidate to document work history either before the exam or after passing. Unlike several other ISC2 credentials, it does not require an experience endorsement. A passing candidate submits the certification application, agrees to the ISC2 Code of Ethics and pays the initial Annual Maintenance Fee. No supervisor letter or employment verification is part of the CC award process.

This distinction matters when comparing credentials. A person can qualify to earn CC without prior security practice, while an employer may still require experience for a particular job. Passing shows exam-level understanding of foundational security concepts. It does not convert unrelated work into cybersecurity experience or demonstrate that a candidate has managed a production security program.

Eligibility examples

What happened to the free exam program

ISC2 announced that the One Million Certified in Cybersecurity program had reached its goal and closed new enrollments. A new candidate should not plan on receiving the earlier free course and exam simply by signing up now. The program’s remaining opportunity is for people who were already issued an eligible exam code. ISC2 states that holders of an unexpired code may schedule and sit by December 31, 2026, subject to the code and program terms.

Existing participants should distinguish three dates: enrollment or course access expiration, exam-code validity, and the final program testing deadline. A course may have its own access period, and a code may have an earlier expiration than the program deadline. The December 31 date does not revive an expired code. If your account has an active code, use the expiration shown there and schedule early enough to find an appointment.

The program and paid options are also distinct. Candidates outside the closed pledge may purchase the standard exam or a currently offered training-and-exam product. A bundle’s preparation access period and exam validity period may differ. Read the terms associated with the exact product you buy instead of assuming that the free-program deadline applies to a paid voucher.

Age, identity and test accommodations

ISC2 says an individual must be 16 years old to sit for an ISC2 examination. A candidate below that threshold should not buy a voucher expecting to bypass the requirement. Candidates who meet the age rule must also make sure the first and last name in the exam account match the identification document presented at the test center. Name changes cannot be fixed on the day of the test; address a mismatch before the appointment.

Candidates who need an accommodation should follow ISC2’s accommodation process before registering, as the exam administrator may need time to review the request. Do not assume that every location, language or appointment format is available everywhere. The current CC outline lists Pearson testing centers and five exam languages; Chinese appointments are available only during selected windows. A language or accessible appointment must be confirmed for the location and date you intend to use.

Common eligibility mistakes

• Treating recommended beginner audience as a compulsory course or experience prerequisite. It is not.
• Assuming the first-year ISC2 Candidate program or free exam pledge is still open to new signups. The pledge enrollment has closed.
• Confusing permission to sit with readiness to pass. Eligibility does not mean no study is needed.
• Assuming the post-exam application requires work experience. CC does not have that endorsement requirement.
• Using an expired free exam code because the program’s final testing date has not yet passed. The code itself must remain valid.
• Ignoring the minimum age and exact name-match requirements until test day.

A readiness check before registration

Ask whether you can explain each current domain in your own words, distinguish paired ideas such as authentication and authorization, identify who is responsible for a cloud configuration, and choose an appropriate first action in a basic incident. These are readiness questions, not formal eligibility tests. If several answers depend on guessing, study before spending money or starting a voucher window.

A candidate who has no IT experience can still prepare successfully by learning basic networking, security vocabulary, governance and response concepts in sequence. A candidate with years in IT should not assume that practical familiarity covers governance, ethics or access-control principles. Use the outline to identify knowledge gaps rather than treating job history as a proxy for exam coverage.

No. ISC2 does not require a degree, prior IT work or cybersecurity experience for CC.

ISC2 states candidates must be at least 16 to sit for an examination. You must also comply with identity and test-center requirements.

No. New enrollment in the One Million pledge is closed. People with existing, valid codes may still have a final testing opportunity through December 31, 2026, subject to their code terms.

No. After passing, CC candidates submit an application, agree to the Code of Ethics and pay the first AMF. They do not need an experience endorsement.

Specific candidate situations

A 17-year-old student with no job may sit for an ISC2 exam under the published minimum-age rule, provided the account, identification and other testing requirements are met. No parent-sponsored experience record or school credential is stated as a CC prerequisite. The candidate should still review local Pearson requirements and have the correct identification for check-in.

A career changer who has worked in retail can take the exam without first obtaining an IT job. Retail experience may provide useful examples of handling sensitive information, procedures and escalation, but it is not converted into a formal eligibility credit. The candidate can study fundamental networking and security topics before paying for an attempt.

A systems administrator with several years of experience is eligible, but experience does not guarantee readiness. The current outline includes governance, ethics, IAM and incident response as well as technical foundations. The administrator should review topics outside daily work instead of assuming familiarity with one network or operating system covers the whole exam.

An individual who received a One Million pledge exam code before new enrollment closed is in a different position from a person who never enrolled. The former should check the actual exam code and account expiration and take the exam by December 31, 2026. The latter cannot claim the discontinued free code and should compare currently available standard registration or training products.

What eligibility does not promise

Meeting the age and account rules means you can register; it does not mean ISC2 guarantees a local appointment in a preferred language or on a chosen date. CAT appointments are delivered through Pearson centers, and language availability can be geographically limited. Check the scheduler early if travel, accessibility or language needs affect your choice.

Eligibility also does not promise a job or qualify someone for a regulated role. CC is a professional certification, not a government license to perform a specific job. Employers decide whether it meets their own hiring criteria. A candidate can accurately say the credential demonstrates a foundational exam standard, but should not represent it as years of professional practice or authorization to handle systems without supervision.

A decision tree for prospective candidates

1. Are you at least 16? If not, you do not meet ISC2’s published exam-age minimum.
2. Do you have an ISC2 account and an acceptable ID with a matching name? Resolve account details before buying or scheduling.
3. Are you relying on a free pledge code? New enrollment is closed; only an existing eligible code may still be used under its deadline and validity terms.
4. Are you ready for the September 2026 outline? If not, study before choosing a date, especially if your code expires soon.
5. Do you understand the cost after a pass? Include the certification application and first US $50 AMF, then plan for ongoing CPE and annual maintenance if you intend to maintain the credential.

This decision sequence keeps legal and administrative eligibility separate from study readiness and long-term maintenance. A prospective candidate can qualify to test, be unprepared, or be ready to test but still need to budget for certification maintenance. Treat those as separate decisions.

Education, experience and accessibility

There is no required school subject or degree path. Learning basic computer systems and networking can make study more comfortable, but it is a preparation choice rather than a formal gate. ISC2’s entry-level framing is intended to make the certification accessible to people without direct IT experience. Candidates should use any available course access responsibly and verify its expiration rather than assuming account enrollment includes perpetual training.

If a disability or medical condition requires testing accommodation, request it using ISC2’s process before selecting the final appointment. Allow time for review and avoid paying for travel before the accommodation and location are confirmed. The exact request and documentation process belongs to ISC2 and its testing provider; a candidate should submit complete information through the official channel rather than relying on an informal note at check-in.

For international candidates, the experience rule is the same, but available languages, local fees, tax, and center appointments can vary. Exam pricing is tied to exam location, and currency may differ. The candidate’s country does not turn CC into a local license; it remains an ISC2 certification. Use the regional price and scheduler shown for the intended testing location.

After passing: no experience verification

A candidate who passes is not asked to obtain a supervisor endorsement or prove months of work. The post-exam steps are an application, agreement to the Code of Ethics and payment of the first AMF. ISC2 requires the application within nine months of passing; a candidate who misses that window must retake the examination. Keep the pass notice and submit the form promptly instead of treating the exam result as the final administrative step.

This does not mean experience is irrelevant to cybersecurity careers. It means only that experience is not an eligibility condition for this credential. A person seeking an operational role should develop practical ability and learn workplace procedures in addition to exam knowledge. The separation helps candidates understand what the credential certifies and what must be learned through work, labs or additional training.

Ask the right question before paying

If you are uncertain, separate three questions: Can I sit? Am I ready? Can I complete the credential steps afterward? For a candidate age 16 or older, with a matching identification record and compliant account, the first answer is generally yes regardless of employment background. Readiness depends on the 2026 outline. Completing certification requires the application, ethics agreement and AMF after a pass. A yes to one does not answer the others.

A useful candidate plan is to budget for the exam and the first maintenance fee, check the latest post-exam application window, and decide whether annual AMF and CPE maintenance fit the candidate’s goals. This is particularly relevant for someone trying CC as an introductory credential. The exam itself may be an accessible starting point, but an active certification is a continuing commitment. Knowing that before purchase prevents surprise after the pass.