ISC2 study plan
ISC2-CC study plan
A step-by-step ISC2-CC study plan: the exact order to study in, how long to spend on each stage, and when to start practice questions. Follow it top to bottom.
The real ISC2-CC is 100 to 125 questions in 120 minutes, pass mark 700 / 1000. For the full domain-by-domain breakdown behind each stage, read the ISC2-CC study guide.
Your step-by-step plan
Map the outline and set a date
Day 1Read the official ISC2 CC exam outline and the five domains with their weights. Book a provisional exam date now: a fixed date turns open-ended study into a plan and is the single biggest predictor of actually sitting the exam.
Lock the security principles (Domain 1)
Week 1Get the CIA triad, the risk vocabulary, control types and functions, and the ISC2 Code of Ethics solid before anything else, because every later domain assumes them. Use the recall prompts in this guide: cover the summary, answer from memory, then reveal.
Master access controls (Domain 3)
Weeks 1-2This is the most error-prone area, so give it dedicated time. Drill the four access-control models until you can name each from a scenario, and keep least privilege, need-to-know, and separation of duties distinct. Practise on scenario questions, not definitions alone.
Work through network security (Domain 4)
Weeks 2-3Learn the OSI and TCP/IP layers, the common ports and protocols, the frequent attacks, and the infrastructure controls. This domain carries real weight and rewards a framework you can reason from, so build the layer model first and hang everything on it.
Cover operations and continuity (Domains 5 and 2)
Week 3Cover security operations (encryption versus hashing, hardening, awareness and policy) and the business continuity, disaster recovery, and incident response concepts. Fix the incident-response phase order and the RTO, RPO, and MTD metrics, which are common distractors.
Practise on scenarios with worked explanations
Week 4Move to full practice sets and read the explanation for every question, including the ones you got right. The exam tests the single best answer among plausible options, so understanding why each distractor is wrong is where the marks are.
Find and close your weak domains
Week 4Use your per-domain accuracy to drill the domains dragging you down rather than re-reading what you already know. Repeat until every domain clears the pass line with margin on questions you have not seen before.
Ready to start stage one?
Free ISC2-CC questions with worked explanations. No sign-up.
Frequently asked questions
How long does this ISC2-CC study plan take?
It is 7 stages, paced by how much time you can give it each week - most candidates work through it in 2 to 6 weeks. Each stage below has a suggested duration; slow down on any stage where the recall checks in the study guide are not landing before moving on.
What order should I study ISC2-CC in?
Follow the stages in order below. They are sequenced deliberately: foundational material first, then the domains weighted heaviest on the exam, then timed practice, with review passes built in rather than left to the end.
Do I need practice questions as part of this plan?
Yes. Reading alone does not surface what you have not actually learned. This plan builds in graded practice, and the full 321-question bank is free to use as you work through each stage.
Is this plan enough on its own, or do I need the full study guide too?
This page is the plan: what to do and in what order. The study guide adds the domain-by-domain breakdown, easy-to-confuse traps, and worked examples behind each stage - read it alongside this plan, not instead of it.
Examworthy is not affiliated with or endorsed by ISC2. This study plan is original material based on the public exam blueprint. We never reproduce live exam items. ISC2-CC and related marks belong to their respective owners.