Training Verdict

Which ISC2 certification first: CC, SSCP, CISSP or CCSP

By Alexander Shick · Updated November 5, 2026

Every ISC2 exam is open to anyone; the experience rule applies when you certify. Pass short of it and you become an Associate of ISC2, with two years to earn the SSCP year and six years for CISSP or CCSP, paying $50 a year meanwhile. Once certified, a single $135 annual maintenance fee covers every ISC2 certification you hold, so adding CCSP to CISSP adds no second fee. CC alone costs $50 a year.

Four ISC2 certifications compared

ISC2 certifications on this site: US exam fees (Americas pricing), experience rules and maintenance from ISC2's pages, checked November 5, 2026. ISC2 does not use exam codes.
CertificationExam formatLevelUS exam feeFormal prerequisiteCycle and yearly fee
CC (Certified in Cybersecurity)Adaptive, 100 to 125 items, 2 hours (outline from September 1, 2026)Entry$199No: no work experience needed45 CPE credits per 3-year cycle; $50 a year
SSCPAdaptive, 100 to 125 items, 2 hours (outline from October 1, 2025)Practitioner$249 ($328 with a second attempt)To sit, no. To certify, 1 year in one of 7 domains; a qualifying degree covers it60 CPE credits per 3 years (45 Group A); $135 a year
CISSPAdaptive, 100 to 150 questions, 3 hours (new outline April 15, 2027)Experienced$749To sit, no. To certify, 5 years in 2 of 8 domains; a degree or approved credential waives 1120 CPE credits per 3 years (90 Group A); $135 a year
CCSPAdaptive, 100 to 150 items, 3 hours (outline from August 1, 2026)Experienced, cloud$599 ($798 with a second attempt)To sit, no. To certify, 5 years in IT, 3 in security, 1 in a CCSP domain; an active CISSP replaces all of it90 CPE credits per 3 years (60 Group A); $135 a year

All four pass at 700 out of 1,000. ISC2 counts experience as full-time work; part-time work and internships count too, under the rules on our CISSP page. After passing CISSP or CCSP you apply to ISC2 for certification, and first-time candidates need an endorser; a CCSP candidate who already holds an ISC2 certification other than CC needs no endorser.

ISC2 ladders from three starting points

ISC2 for newcomers to security

CC tests the basics and asks for no experience. If the job ads you want name Security+, take Security+ instead; if you are new to IT altogether, A+ comes first.

ISC2 from IT administration with security duties

SSCP once you have a year of hands-on security work, or straight away with a degree in computer science, IT or another subject on ISC2's list. It sits between CC and CISSP. Aim at CISSP when you reach five years; an approved credential such as Security+ or CCNA can take one year off.

ISC2 after five years in security

CISSP for broad practice across the eight domains, then CCSP if you secure cloud workloads: the CISSP waiver means you sit the exam and apply. Cloud specialists without CISSP can go to CCSP directly under the five, three and one year rule. If you manage a program rather than practice across domains, read CISM vs CISSP.

What ISC2 changed in 2026

Just before that window, SSCP moved to its current outline on October 1, 2025, a two-hour adaptive exam; course pages that still describe a three-hour, 125-question SSCP exam are out of date.

ISC2's free guides and paid courses

With the free CC program closed, ISC2's free material on our pages is the SSCP and CCSP Ultimate Guides and the SSCP self-assessment, useful checklists rather than courses. Its official training is paid: the CC self-paced course is $255 on its own or $454 with the exam, and the SSCP self-paced course with the exam comes to $609. ISC2 members pay less for self-paced courses, and for CCSP it offers an education guarantee: fail the first attempt and you can retake the same training free within a year of finishing it.

ISC2 fees people miss

Rescheduling an exam costs $50 and cancelling $100. The two-attempt options for SSCP and CCSP require both sittings within 180 days of purchase. A failed CISSP attempt means paying the $749 fee again.

Next step

Ask which ISC2 certification your experience supports

Sources

Prices are published list prices we recorded on the dates shown, not quotes. How we research.