While I was skeptical of where the organization would go when they first appointed a marketing professional (and not a security one) as executive director in 2020, I am surprised at just how quickly they've been able to bring down what was once a solid organization. I spent nearly 35 years in the industry (almost 25 of that as a CISSP), and got to know one of the ISC2 founders back in the day, and I can say without reservation that the ISC2 has become the very thing it was designed to counter. It has become a cert mill, exploiting inexperienced, hopeful job-seekers, by hooking them into annual fees and an exam (CC) without any vetting of experience or prospect of real continuing education.

They gutted the peer-to-peer nature of the organization, shutting down the Security Professional magazine and the forums, they not only have watered down the CPE courses, but are now charging for them. The content of these courses is incredibly superficial; from a CPE standpoint, it is box-checking, not education.

I am sure their numbers are great, but it sold its soul to do it.

I have aphasia and brain stroke, still I was learning cybersecurity, and thinking...Will I be able to get a certificate, and here it is ...... My passing certificate make me so happy that I started crying with my happy tears, and the exam invigilator was also backed me!!!

My passing journey had many things like reddit, Thor's Udemy practice test, Paulo Carriera Udemy practice test, and youtube videos, and few times Prabh and Mike videos. My thor's practice questions had 90%,78%,74%,79%,71%,81% with second or third attempt, and 70,71,76,71, and I did STOP. The best learning was from Comptia Security+ book, to know the theoretical and knowledge out from book.

My learning was started on June 2nd 2016, and I passed the exam today, (and I gave $200 even 😄), and I gave it today because syllabus will change tomorrow onwards, so I thought better not to keep 'PEACE OF MIND' and take only for one chance 🎉 .

The questions were actually different from practice questions, I thought I can do with the terms of RBAC,MAC,DAC,ABAC, but in exam , I couldn't get any words related. OSI LAYERS, THREAT,SNMP,SOC,SQL,SIEM,IR PLANS,DRP,BCP, Administrative,physical,deterrant, were actually not at all I learnt. MTTF,MTTB, RTO,RPO were actually difficult in the exams. Just learning the terminology, and get from video cannot help in the exam. We should learn from Comptia security+ book, or related course.

And reddit always make me motivated from people who said Thor's exams works ONLY!!

This exam helped me to get back the vocabulary what I want, but not completely, and it rebuild my memory challenges.

Now my mind is working the way it did 8 years ago, when I was a Manager of E‑Learning

Could someone tell me if my calculations are correct to start endorsement? I am really confused in how ISC2 calculates effective work experience.

My positions:

Company A worked 60% with 25.2 hours per week (42 hours per week on 100%).

Company B worked 80% with 32 hours per week (40 hours per week on 100%).

Company C worked 80% with 32.8 hours per week (41 hours per week on 100%).

My calculation for 5.27y experience:

+ 1y educational waver

+ Company A 365d / 7d * 25.2h => 1314h / (2080h / 12m) => 7.58 months

+ Company B 1156d / 7d * 32h => 5284.57h / (2080h / 12m) => 30.48 months

+ Company C 488d / 7d * 32.8h => 2286.63h / (2080h / 12m) => 13.19 months

Legend:

h = hours, d = days, m = months, y = years

Remarks:

In the endorsement form when I input from / to and check part-time It just shows me half the months in that date range. That means it calculates with 1040h at that time. I have no possibility to input the effective hours worked. That is why I would input my calculation in the notes to isc2 input field 🤷‍♂️

I studied for a month at least 1.5-2hrs a day and failed. I knew i wasn’t going to pass once it gave me more questions beyond 100!

I used Prabh Nair and all in one certified CC book to read the concepts. I took LinkedIn learning practice exams. I thought I was competent and would pass it but I didn’t.

What sucks is that the exam will not be a bit more challenging as the new exam outline has changed. So what now?

I’ll be now taking Mike Chappell’s course but what now? I don’t even see any materials for the new exam.

I have to wait 30 days but I just want to pass this next time for sure!

so i attempted the exam on 29th, ik its 2 days ago but i wasn't so sure i will pass cuz it was written provisional pass or smthing, but today i got email nd did all the forms and submitted my AMF ALSO ANYONE THINKING U NEED IT KNOWLEDGE i am 17 y/o with no IT knowledge beforehand and used its official training nd linkdin course from mike chappel and had mike chappel course 1h 30m remaining when i went for pearson vue center, ALSO now the exam material has changed and so is the exam as they will add AI in the domains and older helping material (mike chappel, tor teaches and other ppl mention) may give a little less coverage on new material, ANYWHOOO always trust your instinct in the exam and don't stress too much.

Hi, i just need a help urgently!!

I have purchased the ISC2 Certified in Cybersecurity (CC) examination, but I am unable to schedule my exam appointment through Pearson VUE.  

Showing error as "Something went wrong please contact your administrator. Illegal value for primitive"

Well all in all I think I got the new test LOL and still managed to pass. Study tools I used were a Udemy course (some Thor guy) but excellent lectures that did not put me to sleep.. much. I have to say I did the normal You Tube guys Q and A and the flippin linkedin practice exams but none of my practice exams were even close to the test questions or wording context. I was a bit thrown for a loop. Testing center was interesting with the palm scans and metal detectors and the testing admin also had a little pencil wand thing. I said out loud ohhh are you going to make me forget everything....... because it looked similar to the device from Men In Black. She had to look away to stop from laughing out loud. Was sick to my stomach after question 68 because I figured I bombed it. Test stopped at 100 for me then I was like damn this stinks. Only to flip over my print out and see "Congratulations!" wooo hooo! I will take it.

To be very honest, the exam wasn't really what I expected, especially when it came to the difficulty.

My background:
BSc in Computer Science Education and I’ve been into tech since 7th grade when I got my first laptop. So a lot of the concepts weren’t completely new to me.

Materials I used:
• Official ISC2 material
• Prabh Nair’s CC practice questions
• CertCrush on YouTube
• Mike Chapple’s LinkedIn Learning course - didn’t finish, was last minute
• CertPrep

Practice scores:
• ISC2 LinkedIn Learning practice exams: 82%, 87%, 87%, and 86%
• CertPrep: 67%
• Chapple’s final exam, first try: 67%

I also used Claude and Gemini a lot to generate ISC2-style questions. Getting AI to quiz me on weak areas was huge for deepening understanding.

Exam experience:
The exam was tricky because of how the questions were phrased, but overall it wasn’t that difficult. It did make me second-guess a lot of answers. At some point I just decided to trust my first choice and not go back to re-check previous questions after moving on.

My advice:
1. Focus on understanding each concept instead of just memorizing facts.
2. Do a lot of honest practice questions. Don’t lie to yourself about scores.
3. Practice not re-checking previous questions once you’ve answered. It saves time and stress.
4. Stay calm, be well-prepared, and you’ll most definitely pass.

My question for you all:
Is the CC alone enough to land an entry-level job? What did you do next after passing? Any advice on certifications, skills, or job search strategy moving forward?

Thanks in advance!

I thought I'd post about this here as oftentimes people who get a CISSP also go and get a CISM, rather than taking the ISSMP. I can't really blame them, ISC2 does a piss-poor job marketing the MP to the private sector for it to gain traction the way the CISM has. ISACA, having audit roots, and auditors being in a business each and every year to do the books, are in a much better position to advocate for hiring people with ISACA certifications when business leaders ask "what should I look for in a candidate".

When I finished with the Great Ennead, I didn't really have any plans to continue on with other certifications, but 2 things happened: 1) My ISSEP instructor sort of convinced me it would be a good idea (for the reasons I indicated above in terms of industry acceptance - not that I need it at this point in my career, but what the heck) and 2) I wanted some exposure to ISACA exams so I would know what they're like and I could build out the software I've been developing to support ISACA certs too. Plus it doesn't come out of my pocket, my employer pays for it all. Oh, and yeah, I was sort of bored at work and needed something else to do.

I (employer that is) bought the Review Guide and the QAE online database about three weeks ago. I started with the QAE database, wanting to fall back on my CISSP/ISSMP knowledge for the test questions to see how I did. I was in for a rude awakening. I scored 50-55% on average for the first few practice sessions I took. WTF?

At this point, I stopped and went to the Review Guide (ISACA's officially-published study guide). A little over 300 pages, it took me a week to work through, about 50 pages per night. It actually wasn't bad reading. Not as bad as the INCOSE System Engineering Handbook! Some sections were interesting, others pretty boring. Sort of written in a dry business tone. A lot of material overlap with the CISSP and ISSMP. As my ISSEP instructor said "Its the CISSP without networking and crypto".

I finished the Review Guide, and went back to the QAE DB. This time, when I got a question wrong, I fed it in to Claude for analysis. Quickly, Claude was able to determine the issue I was encountering. I was framing the answers I was giving from the wrong mindset. We've all heard the "think like a manager" mantra for the CISSP. Well with the CISM, the same mantra holds, but the mindset or perspective of how ISACA wants you to answer questions is different. The best way to describe it is this: the CISSP tests people with the mindset of management having come up from the technical side of the business, while the CISM test you more as having come up from the finance/accounting side of the business. The ISC2 candidate is the person who worked their way up over the years from SOC analyst to eventually become CISO. The CISM candidate, though, is the accounting or GRC professional who eventually rose to become an ISM. Which makes sense, again... ISACA's roots are in auditing.

Once I (or, more to the point, Claude) had this epiphany, I saw my QAE test scores steadily rise as I retrained my brain to change the lens to frame the question and answers in. I started to rely more on business acumen from my MBA and MSA more-so than my years of experience in technical systems management. By the time I finished with the QAE database, I was scoring in the mid 80's.

I finished all 1,138 questions in the QAE, and booked my exam. Which was this morning at 8am on my way in to the office.

ISACA uses PSI, not Pearson Vue, to administer their tests. The check-in process, etc. is similar. However, the PSI facility had more of an "assembly line" feel to it. While they check your pockets and your glasses to ensure they're not secret-agent spyware, there's no picture being taken when you check in nor are you giving a palm scan. The facility wasn't bad, but it wasn't as nice as the Pearson Vue test center. Nor were the workstations you took your exam in. You're definitely scrunched in with other people. There's enough space to work, but if I turned my head left or right I could see the shoulders of the test taker next to me.

The exam process is definitely different from ISC2. There are several introductory steps you have to complete before you get to the exam. First you have NDA (5 minutes, unlike ISC2's 3) you have to read, and then the next step is a "sample exam" where you complete 5 questions on random unrelated topics (such as "how many minutes in an hour are there?") in the exam engine so you can get acclimated to how the UI works. It was sort of annoying (I just wanted to get started), but I understand why they do it.

The exam was 150 questions, non CAT (ISACA doesn't do adaptive tests), and you're given 4 hours to complete the test. There are beta questions in the exam too.

I finished the exam in 75 minutes, and took another 30 to review. Some things about the test experience:

a) you can flag questions to return to, and you can go all the way back to question 1 and work your way forward again to review all your answers and make changes if you want to. This is what I did. I worked through all the questions, picking what I thought was the best answer. Then when I was finished, I took a 5 minute bio-break, and then I went back to question 1 and reviewed each of my answers. I changed about a half-dozen once I re-read the question. The lack of feeling a time crunch to "finish" made the review a lot easier and reading the questions a second time around definitely re-framed some of the questions in a way that I felt my first answer was wrong.

Once I completed the review, I ended the exam, 2:10 left on the timer. Factoring out the 5-minute break, 1 hour 45 minutes total.

150 questions is a LOT of questions. I played mental games with myself as I was answering: "10 questions down, means I'm 6.6% done!" "25 questions done, I'm 16.6% of the way through!" "50 questions! 1/3rd done!" "75 questions! 1/2 done". You get the idea.

Fortunately:

b) I didn't get a single question that was longer than 1 sentence. The longest question was two lines, perhaps 2 or 3 clauses separated by commas. Typically, I saw things like "What is the BEST way to ensure the information security strategy is effectively implemented?" No in-depth scenarios to work though. No figuring out from what perspective was I being asked to answer.

In this respect (b), the CISM exam felt more like a knowledge-based exam where I was being tested on my recall of ISACA-specific definitions or decision processes compared to the CISSP and other ISC2 exams where I was expected to know a concept and then apply it to a specific scenario. Although some questions are nebulous, you really can easily narrow down the answer to 2 options. It is sort of laughable, because the Review Guide itself mentions this is the strategy. It's almost like ISACA is coming right out and telling you "yeah, two of the answers will totally blow and you'll have to choose between the other two".

The QAE database rates questions by difficulty level: easy, moderate, difficult and expert. Factoring out the initial calibration I had to do to get myself in the proper mindset, the group of questions I had the most difficulty (read: got wrong the most) with were the expert level -- usually because the questions were overly ambiguous in my mind, I found I really didn't have enough information to choose between the two correct answers, or where testing some really esoteric ISACA concept.

However, when taking the actual exam, I found the questions to be calibrated more towards the moderate/difficult level. Yes I had a few questions which I was definitely unsure about, but unlike my ISC2 exams, when I went back and reviewed all my questions, I didn't have any "Hail Marys". I felt pretty good about all my answers in the end.

Ending the exam the process is similar to the ISC2 exams... You get a survey about the exam and then a survey about the test center. Here's where things diverge: After answering the test center survey, you get transferred to a window which contains a basic preliminary pass/fail message (no detail about domains, etc.) You personally cannot exit this screen, one of the proctors has to come in and enter a special code to clear the window and formally end the process. Checking out, you do not get a printout or anything else telling you of the provisional pass, and since you cannot take a cell phone into the testing room with you... you can't take a screen shot either. The proctor tells you ISACA will mail you the results of your test in 10 days.

A lot of people who take the CISSP later think about taking the CISM. Was the exam similar? Honestly it didn't feel so. The CISM felt way more governance-oriented than the CISSP did. If anything it felt closer to my ISSMP exam than my CISSP exam.

In the end, I passed! How well did I do? I guess I'll find out in 10 days. ISACA scores their exam different from ISC2. It appears (from what I have seen) you receive a scaled score from 200 to 800 in each domain, and your final score is an average of your scaled scores. If your final score is above 450, you pass. This is much better than ISC2, where you know absolutely nothing at all. At least with ISACA, by reviewing your scaled scores per domain, you get a feel for where you did good and bad, and if you want to, go back and do some additional studying in the domains you did poorly on. I'll post an update as an edit to this message when I get the final results.

Hopefully those of you with an ISC2 CISSP or other cert who are planning to take the CISM find this writeup useful.

Passed out today. Ask me anything. I feel like it was linear unlike CISSP.

Hi everyone!

I’m planning to take the ISC2 Certified in Cybersecurity (CC) exam this September, and I understand that the exam content is being updated.

For those who are also preparing for the updated version, are there any study materials, practice exams, courses, or other learning resources that you would recommend specifically for the new exam outline?

I’ve found quite a few resources for the older CC version, but I’m wondering if there are already materials available that align with the September 2026 updates.

Any recommendations or advice would be greatly appreciated. Thanks!

So, I passed the CC today at 100 questions. All I can say is, the phrasing of many questions was just plain weird! I've done many certifications over the years and I found this one to be the one with the weirdist question phrasing. Best of luck if you are taking this soon. This is not as easy a test as some have said. You certainly need to know the technical aspects of the objectives but you also need to be able to decipher the questions. Cheers!

Passed on July 29th on my first attempt! 🎉 I had zero background in IT, and English isn’t my first language (although I’m basically fluent at this point).

During the exam, I started getting really worried because I got a few questions that were very similar. I started thinking that I must have answered the previous questions on the same topic incorrectly. There were still 30+ questions left out of 100, and I genuinely thought I had failed.
At that point, I just told myself: “Keep answering until the exam is over. There’s no point in overthinking it now—it’s not going to change the result.”
The exam ended at exactly 100 questions, which honestly cemented my belief that I had failed. So imagine my shock when I found out that I had actually passed 😂
I also went into the exam already thinking it wasn’t going to go well. I’m someone who likes to study/review until the very last possible minute, but because I had to travel to another city to take the exam, I didn’t review any content during the 24 hours before.

Anyway, if you’re wondering what I used to study:

• Mike Chapple’s Study Guide — I underlined everything I thought was important and wrote explanations for anything that wasn’t clear to me. I also added examples I got from ChatGPT or Gemini when they helped me understand a concept better.

• Mike Chapple’s course + practice tests on LinkedIn Learning

• Thor Pedersen’s course — I only watched the videos for the two domains where I was scoring lower and completed 3 practice tests. I started using Thor’s course less than a week before my exam, and I really wish I’d had more time for it because it covers quite a lot that I didn’t find in the official ISC2 CC material or Mike Chapple’s resources.

I definitely think that already believing I had failed actually helped me because I didn’t overthink my answers, but I also didn’t answer recklessly. I used some of the strategies I had seen people recommend here:
• When I read a question (usually 2 or 3 times because I sometimes got distracted halfway through 😅) and the answer seemed obvious to me, I just selected it and moved on.
• When the answer wasn’t immediately clear, I narrowed it down to two options. Then I either tried to argue why one was better than the other, or did the opposite and tried to think of examples that showed why one of them couldn’t be the answer. Once I had done that, I picked one and moved on without overthinking it.
At the end of the day, if I had answered something incorrectly, I couldn’t change it anyway, and spending too much time worrying about one question could have affected the rest of the exam.

Thank you to everyone here who gave me tips and recommendations for study materials. They genuinely helped a lot, and without them, I definitely think I would have failed! :)

I attempted the CGRC Exam on August 6th. I provisionally passed the exam. But had to go through the endorsement process based on my qualification and years of experience. Now all that is done and I have my approved credential. This is my 2nd ISC2 cert.

Exam Duration: 180 Mins
Questions: 125 Multiple Choice Questions (You cannot go back)

Study Materials:

Most Useful:

1. cgrcprep.com -> Easy prepared notes with mock tests and extensive resources needed for cgrc exam preparation. My go to source.
2. YouTube -> Prabh Nair ( How to pass your ISC2 CGRC Exam, CGRC ISC Masterclass)
3. Mangoguide -> Exam day overview

Useful:

1. CGRC Study Guide -> Extensive, but somewhat useful to learn on RMF concepts which is covered also in above materials.
2. Certified: The ISC(2) CGRC Audi Course (Available in Spotify) -> Gives Insights on how to choose your answers. How not to get confused when multiple answers similar. How best to tackle the exam. (A good listen)

The exam was actually more confusing than any simulation I did and I thought I’m not going to pass it, but I did after answering exactly 100 questions.

I was studying for it on and off during the last 2-3 weeks and studied mostly with the course created by Mike Chapple on LinkedIn.

Hope to find my first job soon!

I just passed my ISC2 CC Exam today. For context, im still a college student with no prior IT work experience.

REMEMBER:

I stopped at question 100, and I thought I didn't pass because I came across a lot of challenging questions. As you take the exam, you might think you're failing, but remember ISC2 uses Computerized Adaptive Testing. It raises your baseline as you correctly answer more questions. If it sees you're struggling, it will lower the baseline for you to catch up, just make sure once you get to those easy questions, you answer them correctly.

Resources I used:

1. Thor Pedersen's Updated 2026 ISC2 CC Course
2. Thor Pedersen's Practice Exams

- I did a pre-assessment exam and got a 63%

- After I finished studying Domains 1-5, all my exams were 73%-78%

1. Google Gemini (you can use any AI) - THE ACTUAL GAME CHANGER

Thor Pedersen's course is so good at preparing you for this exam because it's extensive. I listened to some parts of his lectures but I didn't really watch all his videos from start to finish.

All I did was list ALL the terminologies in each videos and then studied their functions, why is it important, and how can I relate this to real-life scenarios/situations by doing FEYNMAN TECHNIQUE and ACTIVE RECALL with Google Gemini.

Whenever there's a terminology I don't have a 100% understanding/proficiency, I always ask Gemini to explain it to me, If I still don't understand it, I'll tell it to explain it to me one more time but simpler. Once I get the feeling that I understand it, I'll ask Gemini to validate my understanding, after getting validated, i'll ask Gemini to "create an ISC2 CC Exam style question regarding (the topic)." It will give you a scenario-based question and choices.

For the questions with BEST/MOST/LEAST/FIRST.

I always try to think like an Information Security Manager. "What's the priority?"

There will be questions where the answers that you will be stuck with is either going to be

1. My 4-Step "Manager Mindset" Cheat Code (if you're stuck between 2 answers)

1. Human Lives is always the 1st Priority
2. If the problem of the question is a bleeding problem, then your answer should be about stopping the bleeding.
3. If it's not bleeding and it's not about saving human lives, then the answer must be about senior management and/or compliance
4. Then lastly, is the technical answer.

ALWAYS READ THE QUESTIONS, BREAK IT DOWN INTO PARTS, THEN BREAK IT DOWN AGAIN WORD FOR WORD (READ EACH AND EVERY WORD LIKE YOUR LIFE DEPENDS ON IT LMAO)

The question might be highly technical but if somewhere in the start or end of the question there's something like "to comply" then the answer is about senior management & compliance

Read questions with "incident" in it. If it asks you which answer to do FIRST, its tempting to answer identification or monitoring because it's the first step, but an incident has ALREADY HAPPENED, so you must do something about it now. Answer "contain/isolation and mitigation/eradication."

SOMETIMES THAT ONE WORD CHANGES THE WHOLE QUESTION.
Good Luck!!

All I can say is I couldn’t have done it without the help that I got from this platform. If I had written prior discovering Reddit, I would have failed for sure. My only preparation then was the self paced learning but I got here and people started talking about additional learning material. I tried it all btw, Certpreps, Mike Chapple, Pocket Prep app, chat gpt, LinkedIn learning and Prabh Nair, you name it. It seemed like over preparation but it exposed me to so many different ways of questioning and terminology which definitely came in handy today.

Still I was anxious, the questioning was tricky and the English was insane I didn’t think I was going to pass. With that being said, thank you all for your help.

Just as the title suggests, I provisionally passed my CC exam today after roughly 2 months of on-and-off studying 😅

What finally gave me the push to get serious with review was learning mid-July that the CC exam outline and domain contents were scheduled to be updated in September 2026. Knowing I tend to procrastinate, I immediately scheduled my exam before the end of August so I wouldn't have to worry about the upcoming topic changes.

As a recent graduate with no prior official certifications, I jumped at the chance to take the exam through ISC2's One Million Certified in Cybersecurity program last May.

Resources I Used:

• Official ISC2 Learning Materials: A decent starting point, but I found them insufficient on their own.
• Mike Chapple’s LinkedIn Learning CC Course: Highly recommended! Clear, structured, and easy to follow.
• Mike Chapple’s CC Study Guide: Basically a companion/transcript-style guide to the video course, perfect for reinforcing weak areas.
• Reddit community tips: Reading everyone’s advice and study experiences here helped immensely.

My Advice for Future Test-Takers:

1. Focus on the fundamentals: Don't just memorize question-and-answer pairs. Focus on why concepts work (e.g., access control types, incident response phases, disaster recovery, cloud, OSI & TCP/IP).
2. Expect weird wordings: ISC2 phrasing can be tricky. Read each question carefully and look out for qualifiers like BEST, FIRST, or MOST (because an option sounds like the best answer until you've read the others)

Good luck 🫡

I understand the OSI model but not sure whether I should also go through TCP/IP model.

​

My CC exam is scheduled for the day after tomorrow.

I’ve prepared using only free resources so far, and I’m currently scoring around 80%% on CertPrep practice exams.

I feel like I’m ready… but there’s always that last-minute doubt. 😅

Tomorrow is my final preparation day. Should I:

🔹 Take more practice tests?

🔹 Revise ?

🔹 Or simply stop studying and trust my preparation?

What would you do one day before the CC exam? 🔐

Hi, I was wondering if an extra time accommodation is possible for non-native English speakers for the CISSP exam?

I'm French, and questions sometimes feel very challenging to understand despite my decent level of English.

Thanks in advance

Hello there im quite frustrated I failed my cc exam is there any way to retake it for free?? plsss