For nearly four years the honest answer to this question was trivial. The exam was free, so the only cost was your time. That ended on 20 May 2026, when ISC2 stopped accepting new participants into its One Million Certified in Cybersecurity programme. CC is now a USD 199 exam with a USD 50 fee attached to it every year you hold it — and almost every “is CC worth it” page still tells you it is free.
This page uses only what ISC2 publishes on its own pages, and says where it publishes nothing. Every figure was verified on 18 September 2026.
What it costs now
| Exam | USD 199 |
| Exam with Peace of Mind Protection | USD 299 — includes two attempts |
| Self-paced training (90 days) + exam | USD 454 |
| Annual maintenance fee | USD 50 a year, while CC is your only ISC2 certification |
| AMF after a second ISC2 certification | USD 135 a year |
| Reschedule fee | USD 50 (Pearson) |
| Cancellation fee | USD 100 (Pearson) |
| Free route | Closed to new entrants since 20 May 2026. Existing unexpired codes may be used until 31 December 2026 |
| Salary uplift | Not published by ISC2 |
The subscription is the part people miss
The USD 199 is a one-off and it is not really the issue. The annual maintenance fee is. It is due every year on your certification anniversary for as long as you want to hold the credential, and if you go on to earn a second ISC2 certification it more than doubles, to USD 135.
Let it lapse and there is a 90-day grace period, then suspension for up to two consecutive years, then termination — at which point getting the credential back means sitting the exam again. So the question is not whether you can afford USD 199 once. It is whether CC will still be earning its keep in year three.
Can you settle a CC question in under a minute?
Timed practice against the two-hour limit, with a written explanation for every answer — so the questions you get wrong are the ones you learn from.
- Full-length timed tests that hold you to the real two-hour limit
- An explanation for every answer, right and wrong
- Original questions written from ISC2’s published outline — never real exam content
On Udemy · lifetime access · 30-day refund policy applies
Straight answer before you click: our CC question bank was written against the previous exam outline and is being rebuilt for the domains that took effect on 1 September 2026. Until that is done it is useful for the fundamentals that did not change — and it does not yet cover the new governance, cloud and threat-intelligence material. We would rather tell you that here than have you find out afterwards.
Comparing entry points? CompTIA Security+ practice tests. Heading for cloud instead? AWS Solutions Architect Associate practice tests.
What ISC2’s own numbers show
ISC2 published the results of the free programme when it closed, and they are worth sitting with. More than one million people enrolled across 178 countries. More than 570,000 took the course. More than 65,000 earned the certification. Nearly 9,000 went on to a second ISC2 certification.
Read that carefully, because it is easy to misread. It is not a pass rate — most of the million never sat the exam at all. What it measures is follow-through, and it says that when the exam was free, the overwhelming majority of people who signed up did not finish. Paying USD 199 changes that calculation in both directions: it is a real barrier, and it is also the commitment device the free version lacked.
Who it is genuinely worth it for
- You are trying to get a first interview in security and need something on the CV that is recognised, accredited and not self-certified.
- You are in IT and moving across. ISC2’s own survey data has 22% of employed CC holders in IT roles — this is a common bridge.
- You need a DoD 8140.03-recognised credential at the entry level.
Who it is not worth it for
A worth-it page that cannot name anyone it is not worth for is a sales page. Three honest cases:
- You already hold Security+ or similar and work in the field. CC sits below it, and you would be adding an annual fee for a credential your CV does not need.
- You want proof of hands-on ability. CC is a knowledge exam with no experience requirement; that is its purpose and also its ceiling.
- You are collecting certifications rather than applying for jobs. The annual fee makes a dormant CC an ongoing cost rather than a one-off souvenir.
Where practice questions fit
Practice questions are a diagnostic, not a syllabus. Their job is to find the domain you are weak in and to train you to commit to an answer quickly, which matters more on an adaptive exam than on a fixed one. Used that way — timed, reviewed, and written from the published outline — they are the most efficient preparation available in the last few weeks.
One caution that matters more than it appears to. Sites offering “real exam questions”, brain dumps or leaked CC content are selling you a violation of the ISC2 Examination Agreement and Non-Disclosure Agreement, and ISC2 states it may revoke certifications and ban you from earning future ones. They are also stale by construction: the outline changed on 1 September 2026, so anything harvested before then describes an exam that no longer exists.
Practise under the clock, not just the syllabus.
The verdict
Worth it if it is the thing standing between you and applications you are otherwise ready to make, and if you expect to keep it current for at least a few years. Much harder to justify as a trophy now that it costs money every single year. For the exam parameters themselves, see our ISC2 Certified in Cybersecurity (CC) exam guide — including the two things that changed in 2026.
Frequently asked questions
Is the ISC2 CC exam still free?
No. ISC2 concluded the One Million Certified in Cybersecurity programme and stopped accepting new participants on 20 May 2026. Existing participants with unexpired exam codes can still sit until 31 December 2026. For everyone else the exam is USD 199.
How much does CC cost in total?
USD 199 for the exam, or USD 299 with Peace of Mind Protection which includes two attempts. Once certified there is an annual maintenance fee of USD 50, every year, which rises to USD 135 if you later earn another ISC2 certification.
Do employers value the CC?
ISC2 publishes survey data saying 65% of employed CC holders work in cybersecurity roles and 22% in IT roles. ISC2 publishes no salary figure, so any number you see quoted comes from elsewhere.
Is CC worth it with no experience?
It is one of the few security certifications with no work experience requirement, which is precisely its purpose. Whether it is worth USD 199 depends on whether you will use it to apply for roles rather than collect it.
What happens if I stop paying the annual fee?
There is a 90-day grace period for outstanding fees and CPE credits. Suspension can last up to two consecutive years; after that the certification is terminated and reinstating it means retaking and passing the exam.
Sources. All exam parameters above come from ISC2’s own CC certification page and exam outline (effective 1 September 2026), its article on the updated exam, its exam policy pages and its Annual Maintenance Fee page, accessed 18 September 2026, together with its 22 April 2026 press release on the conclusion of the One Million Certified in Cybersecurity programme. Exam parameters change; if you spot a discrepancy, check ISC2’s page and tell us so we can correct it.
Disclosure and disclaimer. FoxMedium publishes independent study material. Our practice tests are not official ISC2 content and are not endorsed by, affiliated with, or representative of ISC2 or the official certification examination. All questions are original and written from publicly published exam outlines. We do not host or distribute real exam content. Links to our courses earn us revenue if you enrol. ISC2, CC, Certified in Cybersecurity, CISSP and all related trademarks belong to their respective owners.
