Study guide
Domain Map and Time Allocation
ISC2 Certified in Cybersecurity CC
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
Official 2026 CC Exam Facts and Timeline CAT Format and Beginner Security Judgment Domain Map and Time Allocation 30, 60, and 90 Day Study Plan with Readiness Thresholds
2 Domain 1: Security Principles (24%)
CIA Triad as a Practical Decision Tool Authentication, Authorization, Accounting, and Non-Repudiation Privacy in the CC Outline Beginner Security Decision Scenarios AI Security in Security Principles
3 Domain 1: Risk Management and Security Controls
Risk Identification in Business Context Risk Management Processes Risk Treatment Decisions Security Controls: Technical, Administrative, and Physical
4 Domain 1: Governance, Ethics, Policy, and Privacy
Governance and the ISC2 Code of Ethics Policies, Procedures, Standards, Laws, and Regulations Privacy and AI Governance Due Care, Due Diligence, and Governance Decisions
5 Domain 1: Physical Security Controls
Physical Controls and Their Monitoring Tailgating and Physical Penetration Testing
6 Domain 2: Security Governance - Business Continuity
Business Continuity (BC)
7 Domain 2: Security Governance - Disaster Recovery
Disaster Recovery (DR) Redundancy in Business Continuity and Disaster Recovery
8 Domain 2: GRC Planning
GRC Planning: Purpose, Importance, and Tools
9 Domain 2: Measuring Cybersecurity Effectiveness
Security Metrics, KRIs, and Dashboards AI Security in Governance, Awareness, and Continuity
10 Domain 2 and Domain 5: Security Awareness and Triage
Security Awareness and Organizational Culture Phishing and Password Protection Security Event Triage and Human Review
11 Domain 3: Identity Lifecycle Management
Identification, Authentication, Authorization, and Accountability Multi-Factor Authentication and Password Protection Provisioning, Deprovisioning, and Access Reviews Service Accounts and AI Bots in Identity Management AI Bots and Service Accounts in Identity Management
12 Domain 3: Logical Access Controls
Least Privilege and Separation of Duties DAC, MAC, RBAC, and ABAC
13 Domain 4: Networking Fundamentals
Network Models and IP Addressing Firewalls: Ports and Applications Virtual Private Networks (VPN) Wireless Networks and Embedded Systems
14 Domain 4: Network Security Architecture and Cloud Security
Network Segmentation Defense in Depth and Zero Trust Cloud Characteristics and Shared Security Model Cloud Service Models, Deployment Models, and Shared Security AI in Network Security and Cloud Hosting
15 Domain 5: Incident Response
Incident Response (IR) and the Incident Response Plan Preparing the Incident Response Plan Incident Response Exercises and Tabletops AI in Security Operations and Incident Response
16 Domain 5: Security Monitoring
Logging and Monitoring Security Events
17 Domain 5: Threat Actors and Threat Intelligence
Threat Actors, Threat Intelligence, and Frameworks
18 Domain 5: Data Security
Encryption and Hashing for Data Security Data Handling: Classification, Labeling, Masking, and Sanitization Security of the AI Workspace
19 Domain 5: Asset Protection
Configuration and Change Management Change Management and Asset Protection Asset Lifecycle and End-of-Life Management
20 Domain 5: Data Handling Policy
Data Handling Policy and Classification
21 Domain 5: Security Testing
Security Readiness, Application, and Physical Testing
22 Integrated CC Scenario Labs
Risk and Control Selection Drill Continuity, Recovery, and Response Drill Access Control Design Drill Segmentation and Triage Drill
23 Final 14-Day Review and Exam Readiness
CAT Pacing and 100-125 Item Strategy Missed-Question Notebook and Domain Repair Exam Day Logistics and Rescheduling After Passing: AMF and CPE
Domain Map and Time Allocation
Key Takeaways Explain This Topic AI
The 2026 CC outline has five weighted domains: Security Principles 24%, Security Governance 17.3%, Identity and Access Management 20%, Networking and Cloud Security 21.3%, and Security Operations and Incident Response 17.3%.
Security Principles is the largest domain and supplies the vocabulary the other four domains assume you already know.
Allocate study time by domain weight first, then redirect hours toward your measured weak areas after a diagnostic.
Security Governance and Security Operations and Incident Response are each 17.3 percent, so they are small by weight but high-yield because their ordering, escalation, and recovery items are easy points once practiced.
A healthy week blends reading, scenario translation, recall drills, and timed mixed sets rather than one domain at a time.
Last updated: October 2026
The Five Domains and Their Verified Weights
The CC exam is organized around five domains . Weights shape how many items each area can supply, so they should shape your plan — but a 17.3 percent domain can still decide an item if the question lands on incident ordering or recovery. These weights are confirmed against the ISC2 CC outline effective September 1, 2026 (v01/2026).
- # Domain Exam weight
- 1 Security Principles 24%
2 Security Governance (includes BC and DR redundancy, GRC planning, security awareness, and security metrics) 17.3%
- 3 Identity and Access Management (IAM) Concepts 20%
- 4 Networking and Cloud Security Concepts 21.3%
- 5 Security Operations and Incident Response 17.3%
Security Principles is the largest domain and the foundation: confidentiality-integrity-availability (the CIA triad), authentication versus authorization, non-repudiation, privacy, governance, risk, the ISC2 Code of Ethics, and security control categories (technical, administrative, physical). The other four domains assume this vocabulary, so weak Domain 1 quietly costs you points everywhere.
Networking and Cloud Security (21.3%) and Identity and Access Management (20%) are close behind — expect many practical items on secure protocols, segmentation, cloud responsibilities, and identity and least privilege. Security Operations and Incident Response (17.3%) covers data security, logging and monitoring, threat intelligence, incident response, asset protection, and security testing. Security Governance (17.3%) covers GRC planning, business continuity and disaster recovery, security awareness, and security metrics; it is intensely practical even at this weight.
A Weight-Based Time Allocation
For a candidate with 60 focused study hours , a defensible first-pass allocation tracks the weights:
- Domain Weight Approx. hours
- Security Principles 24% 14
- Security Governance 17.3% 10
- Identity and Access Management (IAM) Concepts 20% 12
- Networking and Cloud Security Concepts 21.3% 13
- Security Operations and Incident Response 17.3% 11
This is a starting budget, not a fixed rule. After a diagnostic quiz, move hours toward measured weakness. If you already know CIA, authentication, and policy but miss segmentation and secure protocols, shift time from Domain 1 to Domain 4. If you work in IT support and know networks but find policy and incident concepts new, push hours into Domains 1 and 2.
What Each Domain Feels Like in Questions
- Domain Common item style
- Security Principles Choose the security goal, ethical response, control type, or risk-aware decision
Security Governance (BC/DR) and Incident Response Identify continuity and recovery terms, order response steps, or pick the escalation action
Identity and Access Management Match identity, authentication factors, authorization, least privilege, and account lifecycle
Networking and Cloud Security Identify secure protocols (TLS, SSH), segmentation, cloud shared responsibility, and defensive placement
Security Operations and Incident Response Select data security, logging and monitoring, incident response, asset protection, and testing practices
The Weekly Mix
Do not read one domain start-to-finish and forget it. Blend four activities every week so concepts stay retrievable under time pressure:
Read and annotate to build vocabulary and concept boundaries.
Scenario review to convert terms into workplace decisions (the real skill the exam tests).
Recall drills to make high-yield facts fast — domain weights, the CIA triad, control categories, business continuity versus disaster recovery.
Timed mixed sets to rehearse pacing and the no-going-back CAT discipline.
High-Yield Facts Hidden Inside Each Domain
Domain weight tells you how many items to expect, but certain compact facts inside each domain repay memorization far beyond their size because they anchor multiple questions. Drill these to instant recall:
Domain 1 (Security Principles): the CIA triad; authentication (proving who you are) versus authorization (what you may do) versus accounting/accountability; non-repudiation; the three control categories (technical, administrative, physical); the difference between a risk, a threat, and a vulnerability; risk treatment options — accept, avoid, mitigate, transfer; and the ISC2 Code of Ethics canons in order.
Domain 2 (Security Governance: BC and DR): business continuity and disaster recovery (subdomain 2.2); GRC planning, security awareness, and security metrics. Incident-response phases are tested in Domain 5.
Domain 3 (Identity and Access Management): the three authentication factor types (something you know, have, are); least privilege and need-to-know; separation of duties; the access-control models (DAC, MAC, RBAC); the account lifecycle from provisioning to deprovisioning.
Domain 4 (Networking and Cloud Security): secure versus insecure protocol pairs (HTTPS over HTTP, SSH over Telnet, SFTP over FTP); the OSI versus TCP/IP layers at a high level; segmentation, DMZ, firewalls, VPNs; cloud service and deployment models with shared responsibility; threat actors and their motivations are covered in Domain 5 (subdomain 5.2).
Domain 5 (Security Operations and Incident Response): data handling and classification; logging and monitoring; threat actors and threat intelligence; the incident response plan and exercises; configuration and change management; asset lifecycle; security testing.
Most candidates who fail do so because Domain 1 vocabulary is shaky, which then drags down items in Domains 3, 4, and 5 that assume those terms. Fix the foundation first.
Scenario: Rebalancing by Evidence
A candidate studies 20 hours and takes a mixed review. They ace definitions but miss items asking for the first incident-response action and items distinguishing authentication from authorization. Their next week should not simply repeat the original table. They should add incident-ordering practice (Domain 5) and account-lifecycle and access scenarios (Domain 3). Domain weights set the budget; missed-question patterns tell you where the next hour pays the most. Treat the domain map like a spending plan — invest most where the exam invests most, but keep a reserve to repair weak decisions before test day.
Source: ISC2 CC Exam Outline effective September 1, 2026 (v01/2026), five domains and weights (outline page, CC Examination Weights), https://www.isc2.org/certifications/cc/cc-certification-exam-outline , checked 2026-10-22.