All certifications / CC / Lessons
CC 2026 outline lessons
Study CC for free
A week-by-week plan with every lesson, quizzes, checkpoint tests, a practice exam and hands-on labs.
Open the CC study planA week-by-week plan with every lesson, quizzes, checkpoint tests, a practice exam and hands-on labs.
Domain 1: Security principles
- Cybersecurity concepts: confidentiality, integrity, availability
- Authentication, authorization and accounting (AAA), non-repudiation, privacy
- Authentication factors and multi-factor authentication
- Risk terms: asset, threat, vulnerability, likelihood, impact
- Risk assessment (qualitative vs quantitative) and treatment: avoid, mitigate, transfer, accept
- Security controls: administrative, technical, physical; preventive, detective, corrective, deterrent
- ISC2 Code of Ethics: preamble and four canons
- CIA applied to AI systems: data poisoning, transparency and bias
Domain 2: Security governance
- Governance, risk and compliance (GRC) and the role of leadership
- Policies, standards, procedures, baselines and guidelines
- Laws, regulations and contractual requirements (e.g. GDPR, HIPAA, PCI DSS)
- Risk appetite, risk tolerance and ownership of risk
- Third-party and vendor risk
- Security awareness training and cybersecurity culture
- Measuring the program: metrics, key risk indicators (KRIs), dashboards and reports
Domain 3: Identity & access management concepts
- Identification, authentication, authorization and accounting
- Least privilege, need to know and separation of duties
- Identity lifecycle: provisioning, role changes, deprovisioning, privilege creep
- Access models: DAC, MAC, RBAC and rule-based
- Privileged access management and separate admin accounts
- Single sign-on and federation basics
- Physical access controls: badges, access control vestibules, guards, CCTV, tailgating
- Periodic access reviews
Domain 4: Networking & cloud security concepts
- OSI and TCP/IP models, IP addressing, common ports (22, 25, 53, 80, 443, 3389)
- Network threats: DoS/DDoS, man-in-the-middle, malware, spoofing, side-channel
- Defenses: firewalls, IDS/IPS, antivirus, VPN
- Network design: segmentation, VLANs, DMZ, micro-segmentation, defense in depth
- Zero trust: never trust, always verify
- Cloud characteristics (on-demand, elasticity, measured service) and service models (IaaS, PaaS, SaaS)
- Deployment models: public, private, community, hybrid
- Shared responsibility model and on-premises data center considerations
Domain 5: Security operations & incident response
- Data security: classification, labeling, retention and secure destruction
- Encryption (symmetric vs asymmetric) and hashing
- Logging, monitoring and SIEM; event triage
- System hardening, configuration management, patching and change management
- Vulnerability management and security testing basics
- Incident response lifecycle: preparation, detection and analysis, containment, eradication, recovery, lessons learned
- Business continuity and disaster recovery: BIA, RTO, RPO, backups and alternate sites
- Best-practice policies (AUP, BYOD, password, privacy) and security awareness