ISC2 certifications
Nine ISC2 certifications, prepared exam by exam: timed practice exams weighted like each exam outline, scenario questions that test judgment, and an AI tutor that explains every answer in your style.
200 free credits · No credit card required
Last updated
Certification paths
ISC2 certifications begin with Certified in Cybersecurity, which needs no experience, and build to the CISSP. Cloud, software and governance specialists have their own certifications, and CISSPs can add a concentration in architecture, engineering or management. Select any certification to see its exam.
Security core
From first job to security leader
Cloud & software
Secure the cloud and the code
Governance & risk
Frameworks, controls and compliance
CISSP concentrations
Specialize once you hold the CISSP
All ISC2 certifications
Filter by track or level. Every card shows the exam you’ll sit, straight from its ISC2 exam outline: how many items, how long it runs, the passing grade and the experience it asks for.
9 certifications
EntrySecurity core
Entry-level Security Analyst
Security principles, incident response and business continuity, access control, network security and security operations.
Experience: None, ISC2’s entry-level certification
Updated exam since Sep 2026
PractitionerSecurity core
Security Administrator
Implement, monitor and administer security: access controls, risk and incident response, cryptography, network and systems security.
Experience: 1 year in one of its 7 domains
ProfessionalSecurity core
Security Manager or Architect
Design, engineer and manage a security program across eight domains, from risk management and architecture to operations and software.
Experience: 5 years in 2 or more of its 8 domains
New exam outline from Apr 15, 2027
ProfessionalCloud & software
Cloud Security Architect
Design, manage and secure data, applications and infrastructure in the cloud, with the legal and compliance side included.
Experience: 5 years in IT, 3 in cybersecurity, 1 in its domains
Updated exam since Aug 2026
ProfessionalCloud & software
Application Security Specialist
Build security into every phase of the software lifecycle: requirements, architecture, implementation, testing, deployment and the supply chain.
Experience: 4 years in one of its 8 domains
PractitionerGovernance & risk
GRC Analyst
Authorize and maintain information systems with risk frameworks such as NIST’s: scoping, selecting and assessing controls, and staying compliant.
Experience: 2 years in one of its 7 domains
ConcentrationCISSP concentrations
Chief Security Architect
Develop, design and analyze security solutions, and give senior management risk-based guidance on architecture.
Experience: CISSP + 2 years in its domains (or 7 years in total)
ConcentrationCISSP concentrations
Security Systems Engineer
Engineer security into systems, applications and business processes, from requirements through verification and validation.
Experience: CISSP + 2 years in its domains (or 7 years in total)
ConcentrationCISSP concentrations
Security Program Leader
Lead an information security program: strategy, risk, security lifecycle, incident management, continuity and the business case.
Experience: CISSP + 2 years in its domains (or 7 years in total)
Exam details from the exam outlines on isc2.org, checked weekly for changes; last updated November 5, 2026. Every ISC2 exam is scored out of 1,000 points. ISC2 and the names of its certifications are trademarks of ISC2, Inc.
Built for ISC2 exams
ISC2 exams reward judgment more than recall, and most adapt to you as you answer. Every tool works toward the exam you’ll actually sit.
Practice exams weighted like each exam outline’s domains and timed like the real thing, so a variable-length adaptive exam holds no surprises.
Learn more: Timed practice examsScenario questions where every answer looks right, so you learn to pick the one ISC2 is after: the best answer for the business.
Learn more: Think like a managerGot one wrong? The tutor explains why, in the way you learn best, and points to the exam outline topic behind it.
Learn more: An AI tutor on every answerPractice the access control, network security and incident response skills behind the questions, in guided labs.
Learn more: Hands-on labsA readiness score across every domain, so you book the exam when the numbers say you’ll pass.
Learn more: Know when you’re readyFAQs
Find quick answers or contact our support team.
Certified in Cybersecurity (CC) if you’re new to security: it needs no experience. With a year in the field, the SSCP proves hands-on skill; with five, the CISSP is the goal most security careers build toward.
Yes. Pass the exam and you become an Associate of ISC2, then have six years to earn the experience. A relevant degree or an approved credential can count for one of the five years. The SSCP, CCSP, CSSLP and CGRC work the same way, with their own windows.
Out of 1,000 points; you need 700 to pass. The CC, SSCP, CISSP and CCSP use computerized adaptive testing, so the number of items varies (100 to 150 for the CISSP, in 3 hours). The CSSLP, CGRC and the concentrations have a fixed 125 items in 3 hours.
Yes. From April 15, 2027, the CISSP exam follows a new exam outline, with the same eight domains reworked and reweighted. The CC exam moved to a new outline on September 1, 2026, and the CCSP on August 1, 2026. Study for the outline in force on your exam date.
ISSAP (architecture), ISSEP (engineering) and ISSMP (management) let a CISSP go deeper in one area. Each needs an active CISSP plus two years of experience in its domains, and has a 125-item, 3-hour exam.
Earn continuing professional education (CPE) credits across each three-year cycle and pay the annual maintenance fee. ISC2 sets the number of credits per certification.
OpenpassAI
Hi 👋 I’m OpenpassAI. Ready to prepare for your exam the smarter way?
Ready to explore OpenpassAI? I can show you how the platform helps you prepare, practice, and pass.
