Is (ISC)2 CC still free in 2026?

Not for new candidates. The One Million Certified in Cybersecurity program that offered CC free stopped accepting new participants on May 20, 2026. If you already hold an exam code from that program, you can still use it through the end of 2026; otherwise CC is a paid exam today.

Do I need Security+ before CISSP?

No, they are not formally linked. But most candidates naturally earn Security+ years before they qualify for CISSP, simply because CISSP requires five years of relevant work experience that a Security+-level role helps you build toward.

Can I get CISSP without five years of experience?

Yes, through the Associate of ISC2 pathway. You can pass the CISSP exam with no experience and become an Associate of ISC2, then you have up to six years to earn the required five years of experience and convert to full CISSP status.

Which certification should a complete beginner start with?

CC if you have no IT or security background at all. Security+ if you already have general IT experience - it is more widely required by employers and CC will feel redundant.

How much does each certification cost?

Roughly USD 199 for CC (new candidates), USD 400-440 for Security+ at list price, and roughly USD 750 for CISSP, plus CISSP's ongoing annual maintenance fee. Prices change and vouchers can lower the real cost, so confirm current pricing before you register.

Is CISSP harder than Security+?

Yes, substantially. CISSP assumes years of hands-on experience and tests strategic, program-level judgment across eight domains, while Security+ tests applied technical knowledge with no experience prerequisite.

Does CompTIA Security+ expire?

Yes. Security+ certifications require continuing education or renewal through CompTIA's program to remain active, similar to how CISSP requires an annual maintenance fee and continuing professional education.

Which of the three is most recognized by employers?

Security+ appears in the widest range of entry-level and junior job postings and is also recognized for U.S. Department of Defense 8570/8140 compliance roles. CISSP carries the most weight for senior and leadership security positions once you have the experience to qualify.

Security+ vs CISSP vs CC: Which Security Certification Path Is Right for You?

Cybersecurity certifications are often marketed as if they compete with each other, but (ISC)2 Certified in Cybersecurity (CC), CompTIA Security+ (SY0-701), and (ISC)2 CISSP actually sit at three distinct career stages. Confusing them wastes study time and, in CISSP's case, can mean studying for a certification you are not yet eligible to hold. This guide compares all three head-to-head - audience, experience requirements, cost, and difficulty - and ends with a clear recommendation for wherever you are today.

The three certifications at a glance

(ISC)2 Certified in Cybersecurity (CC) - true entry-level, no experience required, aimed at people with zero security background.
CompTIA Security+ (SY0-701) - vendor-neutral junior/associate baseline, the certification most widely required for entry-level and help-desk-to-security roles.
CISSP - senior-level, requires five years of relevant work experience, aimed at experienced practitioners moving into security leadership and architecture roles.

(ISC)2 Certified in Cybersecurity (CC)

CC is (ISC)2's entry-level certification, built for people with no prior cybersecurity experience - career switchers, students, and IT staff moving into security for the first time. There is no work experience requirement to sit the exam, which is a 2-hour, 100-125 question test across five domains:

Security Principles (roughly 26%)
Business Continuity, Disaster Recovery, and Incident Response Concepts (roughly 10%)
Access Controls Concepts (roughly 22%)
Network Security (roughly 24%)
Security Operations (roughly 18%)

Between 2022 and May 2026, (ISC)2 ran a program offering CC free to one million people worldwide. That program stopped accepting new participants on May 20, 2026. Anyone who already holds an exam code from it can still use it through the end of 2026. For anyone starting today, CC is a paid exam - roughly USD 199 plus a small annual maintenance fee - so do not assume it is still free without checking your own eligibility.

CompTIA Security+ (SY0-701)

Security+ is the most common baseline security certification and is often the first one employers actually list in job postings. It is vendor-neutral, requires no prerequisite, and covers five domains:

General Security Concepts (roughly 12%)
Threats, Vulnerabilities, and Mitigations (roughly 22%)
Security Architecture (roughly 18%)
Security Operations (roughly 28%, the largest domain)
Security Program Management and Oversight (roughly 20%)

Security+ is also recognized for U.S. Department of Defense 8570/8140 baseline compliance roles, which CC is not. It costs roughly USD 400-440 at list price (CompTIA raised prices across its exam lineup in mid-2026), though vouchers through employers, schools, or bundles are often cheaper. Most candidates with some IT background need 4-8 weeks of part-time study; complete beginners typically need longer.

CISSP

CISSP is (ISC)2's senior-level certification and the most experience-gated of the three. To earn it, you need at least five years of cumulative, paid work experience in at least two of the eight CISSP domains. A relevant bachelor's or master's degree can offset one year of that requirement.

Security and Risk Management
Asset Security
Security Architecture and Engineering
Communication and Network Security
Identity and Access Management (IAM)
Security Assessment and Testing
Security Operations
Software Development Security

If you pass the CISSP exam without the required experience, you are not turned away - you become an Associate of ISC2 and have up to six years to accumulate the five years of experience needed to convert to full CISSP status. This lets ambitious junior professionals prove the knowledge early and grow into the credential over time.

The exam itself costs roughly USD 750 plus regional taxes, and CISSP holders pay an annual maintenance fee (roughly USD 135, or USD 50 for Associates of ISC2). It is a longer, harder, and far more expensive commitment than CC or Security+, which is appropriate given the seniority it represents.

Difficulty and depth compared

CC tests foundational awareness: can you recognize core security concepts and terminology? Security+ tests applied, practical knowledge: can you identify threats, configure controls, and reason about security architecture? CISSP tests strategic, managerial-level judgment across an entire security program, assuming you already have the hands-on experience to draw on. Moving from CC to Security+ is a moderate step up in technical depth. Moving from Security+ to CISSP is a much larger jump, and it is one most people should not attempt without the years of experience CISSP assumes, regardless of how much they study.

Cost and commitment side by side

CC: roughly USD 199 for new candidates plus a small annual fee, no experience required, 2-hour exam.
Security+: roughly USD 400-440 at list price, no experience required, single exam, renewable through CompTIA's continuing education program.
CISSP: roughly USD 750 plus an ongoing annual maintenance fee, five years of relevant experience required (or the Associate of ISC2 pathway), a longer and more difficult exam.

Which path fits you

Complete beginner, no IT or security background

Start with CC. It is designed exactly for this situation, builds vocabulary fast, and gives you a credible line on your resume while you decide whether security is the right direction.

IT professional moving into security (help desk, sysadmin, network admin)

Go straight to Security+. It is the most requested entry point for security roles, vendor-neutral, and directly useful on the job. You can skip CC if you already have general IT experience - it adds little for someone who already understands core IT concepts.

Early-career security professional with 1-4 years of experience

Earn Security+ first if you have not already, then start accumulating the two-domain experience CISSP requires. Consider the Associate of ISC2 pathway: pass the CISSP exam early to prove the knowledge, then convert to full CISSP once your five years are in.

Experienced practitioner with 5+ years across security domains

Go directly for CISSP. You already meet the experience bar, and it is the most recognized senior-level security credential for leadership, architecture, and governance roles.

Recommended sequence

No security background: CC, then Security+ once you have some hands-on exposure.
General IT background: Security+ as your first security certification.
Building toward seniority: Security+ (if not already held), then either wait for five years of experience or pursue the Associate of ISC2 pathway toward CISSP.
Already senior with 5+ years of relevant experience: CISSP directly.

The bottom line

CC, Security+, and CISSP are not rivals - they are checkpoints on the same road. CC proves you understand the basics with zero experience required. Security+ proves you can apply security concepts on the job and is the certification most employers actually screen for at the junior level. CISSP proves you have both the depth and the years of experience to operate at a senior level, and it gates on that experience deliberately. Pick the one that matches where you are today, not the one that sounds most impressive.

Practice CompTIA Security+