Short answer: Pick ISC2 CC (Certified in Cybersecurity) if you are brand new to security, want a low-cost first credential, and need a gentle step toward a later ISC2 certification such as the CISSP. Pick CompTIA Security+ if you want the credential that most entry-level security job postings and many government and contractor roles ask for, and you can handle a harder exam with performance-based questions. The two are not equal in weight. CC is a true entry-level starter: a 2-hour adaptive exam of about 100 to 125 items, a 700 out of 1,000 pass mark, an exam fee of USD 199 and no work experience requirement. Security+ is a broader, more technical exam: up to 90 questions in 90 minutes, a 750 pass mark on a 100 to 900 scale, and CompTIA recommends hands-on experience before you sit it. If you can only afford one and your goal is a hands-on security job, Security+ is usually the stronger signal to employers. If your goal is to test the field cheaply, build confidence and stay in the ISC2 path, CC is the lighter start. Many people do both, CC first and Security+ second.
Key takeaways
- CC is easier to enter. It has no prerequisites, a USD 199 exam fee and a USD 50 annual maintenance fee after you pass.
- Security+ is more technical. It includes performance-based questions and a wider set of hands-on topics.
- Both are changing. ISC2’s CC outline changed on September 1, 2026, and CompTIA’s Security+ SY0-801 is expected around November 17, 2026, with SY0-701 retiring on June 11, 2027 in English.
- Employers recognize Security+ more often in entry-level job listings, but CC is a recognized ISC2 credential and a natural first step before the CISSP.
- The free CC route is closing. The One Million Certified in Cybersecurity program stopped taking new enrollments on May 20, 2026, and unexpired codes work through December 31, 2026.
- Neither one needs to come first. You can take Security+ without CC, and you can take CC without Security+.
Quick Facts: ISC2 CC vs Security+
| Item | ISC2 CC | CompTIA Security+ |
| Full name | Certified in Cybersecurity | CompTIA Security+ |
| Issued by | ISC2 | CompTIA |
| Level | Entry level | Entry to early career |
| Exam format | Computerized adaptive testing (CAT), about 100 to 125 items | Up to 90 questions, multiple choice and performance-based |
| Exam time | 2 hours | 90 minutes |
| Passing score | 700 out of 1,000 | 750 on a scale of 100 to 900 |
| Prerequisites | No specific prerequisites; basic IT knowledge recommended | No formal prerequisite; CompTIA recommends hands-on security experience |
| Exam fee | USD 199 in most regions | About USD 425 for SY0-701 per third-party reports; check CompTIA’s store |
| Annual fee | USD 50 annual maintenance fee after certification | Renewal needs continuing education; check CompTIA’s current renewal rules and fees |
| Current exam version | Outline effective September 1, 2026 | SY0-701 now; SY0-801 expected around November 17, 2026 |
| Validity cycle | 3-year cycle with continuing professional education | 3 years with continuing education |
| Retirement notes | New outline replaced the old one on September 1, 2026 | SY0-701 English retires June 11, 2027 |
Figures come from the ISC2 CC exam outline and CompTIA’s published Security+ information as summarized in our own exam-update guides, checked in November 2026. Fees, dates and policies change, so confirm on the official ISC2 and CompTIA pages before you pay.
What Is the Difference Between ISC2 CC and Security+?
ISC2 CC proves that you understand the basic language and concepts of cybersecurity: principles, governance, access control, network and cloud security and security operations. It is built for people who are new to the field, including career changers and students. Security+ proves that you can apply core security skills: spotting threats, choosing controls, working in operations and supporting security programs. It is built for people who are heading into hands-on roles such as security analyst, SOC analyst or systems administrator with security duties.
In short: CC says “I understand the foundations.” Security+ says “I can do the entry-level work.”
A second difference is the sponsor. ISC2 also runs the CISSP, so CC sits at the bottom of a path that leads to leadership-level credentials. CompTIA runs a ladder of IT certifications, and Security+ leads into CySA+, PenTest+ and SecurityX. Our CySA+ vs Security+ guide covers the next step on that ladder.
What Is ISC2 CC?
ISC2 CC is an entry-level certification from ISC2. Its content is organized into five domains. After ISC2’s outline took effect on September 1, 2026, the domains are:
| Domain | Reported weight |
| 1. Security Principles | 24% |
| 2. Security Governance | 17.3% |
| 3. Identity and Access Management (IAM) Concepts | 20% |
| 4. Networking and Cloud Security Concepts | 21.3% |
| 5. Security Operations and Incident Response | 17.3% |
ISC2’s outline page lists the domain names and the September 1, 2026 effective date. The percentages above are reported by study-guide sites and add up to 99.9% because of rounding, so confirm them against the current ISC2 outline. Before the change, the domains were Security Principles (26%), Business Continuity, Disaster Recovery and Incident Response Concepts (10%), Access Controls Concepts (22%), Network Security (24%) and Security Operations (18%). For a full breakdown of what moved, read our ISC2 CC exam update guide.
Exam facts reported from ISC2 sources:
- Format: Computerized adaptive testing. You cannot go back to a question after you answer it.
- Length: 100 to 125 items in 2 hours. The range exists because the test is adaptive.
- Passing score: 700 out of 1,000, a scaled score rather than a count of correct answers.
- Delivery: At Pearson test centers, per the exam outline and FAQ.
- Fee: USD 199 in most markets.
- Annual maintenance fee: USD 50 for the first AMF after certification.
- Experience: None required. The minimum age is 16 per one prep provider, and candidates agree to the ISC2 Code of Ethics.
- CPE: One prep provider reports 45 continuing professional education credits over the three-year cycle. Confirm this on ISC2’s page.
What Is CompTIA Security+?
Security+ is CompTIA’s foundational security certification. It tests general security concepts, threats and vulnerabilities, security architecture, security operations and program management.
Two versions matter right now:
| SY0-701 | SY0-801 | |
| Status | The exam you can book now | Expected on or around November 17, 2026, English only at launch |
| Retirement | English version retires June 11, 2027; Japanese, Portuguese, Spanish and Thai versions retire August 13, 2027 | New version |
| Format | Up to 90 questions, multiple choice and performance-based, 90 minutes | Same format reported |
| Passing score | 750 on a scale of 100 to 900 | Same reported |
Domain weights, as reported in our SY0-701 vs SY0-801 guide:
| Domain | SY0-701 | SY0-801 |
| General Security Concepts | 12% | 16% |
| Threats, Vulnerabilities (701) or Attacks (801) | 22% | 24% |
| Security Architecture | 18% | 19% |
| Security Operations | 28% | 27% |
| Program Management and Oversight | 20% | 14% |
CompTIA has not published an SY0-801 price at the time of writing, and exam vouchers are exam-specific, so a voucher bought for one version does not work for the other. Read CompTIA’s own Security+ V8 page for the latest launch date and price.
How Do the Exams Compare?
| Feature | ISC2 CC | Security+ |
| Time | 2 hours | 90 minutes |
| Items | About 100 to 125 (adaptive) | Up to 90 |
| Question style | Multiple choice and advanced item types | Multiple choice and performance-based |
| Can you go back? | No, once answered | Check CompTIA’s exam rules |
| Pass mark | 700 of 1,000 | 750 of 900 |
| Result | You learn pass or fail within minutes per one provider | Check CompTIA’s rules |
| Scoring note | Scaled score; the numeric score is confidential per one provider | Scaled score |
| Depth | Concepts and terminology | Applied skills and scenarios |
Two practical points. First, CC gives you roughly 1 minute 12 seconds to 1 minute 36 seconds per item if you use all 2 hours, so pace yourself. Second, Security+ performance-based questions are not like multiple choice. They ask you to configure, identify or order steps, and they take longer, so practise them before exam day.
How Do Costs Compare?
| Cost item | ISC2 CC | Security+ |
| Exam fee | USD 199 in most regions | About USD 425 for SY0-701 per third-party reports; SY0-801 price not yet published |
| Annual fee | USD 50 annual maintenance fee | Renewal needs continuing education; check CompTIA’s current rules and fees |
| Retake | A new exam registration is needed; check ISC2’s retake policy | A new voucher is needed; check CompTIA’s retake policy |
| Study material | Free and low-cost options exist, plus paid courses | Official and third-party courses and books, so budget extra |
| Free route | The 1MCC program closed to new enrollment on May 20, 2026; unexpired codes work through December 31, 2026 | None |
If you already hold a free CC exam code, check its expiry date. If it is valid, using it is a low-risk way to test the field. If you do not have one, CC is still less than half the exam price of Security+ at the reported figures.
Which Is Harder?
Neither organization publishes a difficulty rating, so any claim is a judgment. The documents show a clear difference in depth. CC is a concept-level exam with no prerequisites and an adaptive format. Security+ expects you to apply concepts in scenarios, includes performance-based tasks and recommends hands-on experience. Most candidates find Security+ the more demanding of the two, but a strong first-time candidate can pass either with a focused plan.
Which Do Employers Value More?
For entry-level hands-on security roles, Security+ appears more often in job listings and is widely recognized, including in many government and contractor roles. Check the current requirements of the specific jobs you want, because rules for government roles change. CC is recognized as an ISC2 credential and is useful as a first step, especially if your long-term plan includes the CISSP or another ISC2 certification. For career context across the whole field, see our best cybersecurity certifications roundup. We do not quote salary numbers here, because they vary by employer, region and role.
Which One Fits Which Person?
| Your situation | Better fit | Why |
| Complete beginner testing whether security is for you | CC | Lower cost, no prerequisites, gentle introduction |
| Career changer targeting a SOC or analyst job | Security+ | Common job requirement and applied skills |
| Student building a resume | CC first, Security+ next | Low barrier now, stronger credential later |
| IT support or admin moving into security | Security+ | Builds on your existing technical skills |
| Aiming for CISSP in several years | CC, then Security+ or experience | Natural start on the ISC2 path |
| Working toward a government or contractor role | Security+ | Frequently requested; verify the requirements of your target role |
| On a tight budget | CC | Lower fee, and a free code may still be valid |
| Want one credential only | Security+ | Wider recognition in job postings |
Should You Take Both?
Many people do. A common sequence is CC first to learn the vocabulary and test your interest, then Security+ to prove applied skills. The content overlaps in access control, networking, threats and operations, so your CC study carries over. Doing both at once is rarely necessary. If you only have time for one, choose by your target job.
What Should You Do About the Version Changes?
Both exams have just changed or are about to change, so timing matters.
- CC: The new outline took effect on September 1, 2026. Study from material that matches the new five domains, including the new Security Governance domain. Older books may emphasise business continuity and disaster recovery as a separate domain.
- Security+: If you can sit SY0-701 within a few months, it is the supported choice, and English SY0-701 retires June 11, 2027. If you will not be ready until spring or summer 2027, study for SY0-801 and watch for CompTIA’s launch announcement. Avoid buying an SY0-701 voucher unless you are sure you will sit before it retires.
For a deeper look at the Security+ version choice, read our SY0-701 vs SY0-801 guide.
A 6-Week Study Plan for Either Exam
This is a suggested pace, not a requirement. Adjust it to your schedule.
| Week | CC focus | Security+ focus |
| 1 | Read the ISC2 outline; learn core security principles and governance terms | Read the CompTIA objectives; check which version you are studying |
| 2 | Security principles: confidentiality, integrity, availability, risk, ethics | General security concepts, threat actors, attack types |
| 3 | Governance: policies, standards, laws, compliance basics | Vulnerabilities, malware, social engineering |
| 4 | IAM concepts: authentication, authorization, access models | Security architecture: networks, cloud, cryptography basics |
| 5 | Networking and cloud security concepts | Security operations: monitoring, incident response, hardening |
| 6 | Security operations and incident response; practice items | Program management; performance-based practice and a full mock exam |
For Security+ practice material, see our Security+ practice test and our guide to network security basics.
Is It Worth Getting an Entry-Level Security Certification?
It can be, if your target employers ask for it or you need structure to start. A certification does not replace hands-on practice. Pair either exam with home-lab work, such as setting up a small network, reading logs and practising incident response steps. Read our Is Security+ worth it guide for a longer look at the value question. Because salary and demand differ by market, check job listings where you want to work.
FAQS
What is the difference between ISC2 CC and Security+?
CC is an entry-level ISC2 certification that tests foundational concepts across five domains. Security+ is a CompTIA exam that tests applied entry-level security skills, including performance-based tasks.
Which is better for beginners, CC or Security+?
CC is the gentler start, with no prerequisites and a lower fee. Security+ is more demanding and widely requested in job postings, so it can be the stronger signal if you are ready for it.
How many questions are on the ISC2 CC exam?
About 100 to 125 items in 2 hours, because the exam is adaptive.
How many questions are on Security+?
Up to 90 questions in 90 minutes, mixing multiple choice and performance-based items.
What is the passing score for CC?
700 out of 1,000.
What is the passing score for Security+?
750 on a scale of 100 to 900.
How much does the CC exam cost?
USD 199 in most regions, plus a USD 50 annual maintenance fee after you certify. Check ISC2’s current pricing.
How much does Security+ cost?
Third-party reports put SY0-701 at about USD 425. CompTIA has not published an SY0-801 price, so check CompTIA’s store.
Is the ISC2 CC exam free?
The One Million Certified in Cybersecurity program stopped taking new enrollments on May 20, 2026. Existing unexpired codes can be used through December 31, 2026. Confirm with ISC2.
Did the CC exam change in 2026?
Yes. ISC2’s outline took effect on September 1, 2026 and lists five domains, including Security Governance and Networking and Cloud Security Concepts.
Is Security+ changing?
Yes. SY0-801 is expected around November 17, 2026, and English SY0-701 retires on June 11, 2027. Check CompTIA’s page for confirmed dates.
Should I take CC or Security+ first?
If you are new and want a low-cost start, take CC first. If your goal is a hands-on job and you already have some IT skills, you can go straight to Security+.
Is CC or Security+ worth it?
It depends on your goal and market. Review job listings for the roles you want, and weigh the exam fee, study time and ongoing renewal requirements.
Final Thoughts
CC and Security+ answer different questions. CC says you understand the foundations of cybersecurity and are ready to build on them. Security+ says you can handle entry-level security tasks. Choose by the job you want next and the budget you have, then check exam versions and fees on the official ISC2 and CompTIA pages before you pay.
