Cybersecurity Foundations: Prepare for the ISC2 Certified in Cybersecurity (CC) Exam

What's inside

1. Level 1: Exam Notice, CIA Triad, AAA and PrivacyFree
   [Security Principles] Opens with the course notice (ISC2 and CC are registered marks of ISC2, Inc.; this course is independent, not affiliated with, endorsed or approved by ISC2, and not official training; the exam outline is ISC2's, free on its website, and is not reproduced here; the exam lasts 2 hours, has 100-125 adaptive items and needs 700 of 1000 to pass; no pass is promised), then teaches confidentiality, integrity, availability, authentication, authorization, accounting, non-repudiation and privacy through workplace examples.
2. Level 2: Risk Management Lifecycle and Control TypesFree
   [Security Principles] Teaches the risk management lifecycle step by step: identify assets, threats and vulnerabilities; assess likelihood and impact; treat the risk by avoiding, mitigating, transferring or accepting it; then monitor. Shows how technical, administrative and physical controls are used to treat risk.
3. Level 3: Regulations, Frameworks, Policies and Procedures
   [Security Principles] Explains the hierarchy from external regulations and frameworks such as ISO standards and the CIS Controls down to internal policies, standards, procedures and guidelines, and which of these are mandatory.
4. Level 4: Due Care, Due Diligence and the Code of Ethics
   [Security Principles] Explains due care and due diligence, describes the four canons of the ISC2 Code of Ethics in our own words and in their order of priority, and lists where AI concepts appear in each of the five exam domains.
5. Level 5: Governance, Risk and Compliance (GRC)
   [Security Governance] Teaches how governance, risk management and compliance work together, covering roles, accountability, oversight, audit, and the governance of AI assets and AI use in the organization.
6. Level 6: Business Continuity and Disaster Recovery
   [Security Governance] Teaches the purpose, parts and testing of business continuity and disaster recovery plans, including business impact analysis, RTO, RPO, backups and alternate sites.
7. Level 7: Awareness, Culture, Metrics, KRIs and Dashboards
   [Security Governance] Teaches how security awareness training builds a security culture, and how metrics, key risk indicators, dashboards and reports tell leadership how well the program is working.
8. Level 8: The Identity Life Cycle
   [Identity and Access Management (IAM) Concepts] Teaches the identity life cycle from role definition and provisioning through periodic access review to deprovisioning, for people, service accounts and AI agents.
9. Level 9: Least Privilege and Separation of Duties
   [Identity and Access Management (IAM) Concepts] Teaches least privilege, need-to-know, separation of duties, two-person control and privileged access management, and how they limit misuse and fraud.
10. Level 10: Access Control Models and Authentication
    [Identity and Access Management (IAM) Concepts] Compares the DAC, MAC, RBAC and ABAC access control models, and explains authentication factors, MFA and single sign-on, with both logical and physical access examples.
11. Level 11: OSI, TCP/IP, IPv4 and IPv6
    [Networking and Cloud Security Concepts] Teaches the layers of the OSI and TCP/IP models, common ports and protocols, and the main differences between IPv4 and IPv6 addressing.
12. Level 12: Firewalls, VPNs, Wireless, ICS and IoT
    [Networking and Cloud Security Concepts] Teaches how firewalls and VPNs protect traffic, how to secure wireless networks, and the particular risks of industrial control systems (ICS) and IoT devices.
13. Level 13: Segmentation, Defence in Depth and Zero Trust
    [Networking and Cloud Security Concepts] Teaches network segmentation, VLANs, DMZs and micro-segmentation, and how they support defence in depth and the zero trust principle of never trust, always verify.
14. Level 14: Cloud Models and Shared Responsibility
    [Networking and Cloud Security Concepts] Teaches the characteristics of cloud computing, the IaaS, PaaS and SaaS service models, the public, private, hybrid and community deployment models, and the shared responsibility model.
15. Level 15: Data Handling, Encryption and Hashing
    [Security Operations and Incident Response] Teaches data classification, labelling, retention and destruction, then symmetric and asymmetric encryption, hashing, and why quantum-resistant cryptography is being introduced.
16. Level 16: Logging, Monitoring, Triage and Incident Response
    [Security Operations and Incident Response] Teaches logging and monitoring, including SIEM and AI-assisted monitoring, alert triage, and the phases of the incident response plan and how it is tested through exercises.
17. Level 17: Threats, Intel, Asset and Change Mgmt, Testing
    [Security Operations and Incident Response] Teaches threat actors (including AI-driven automated threats), threat intelligence and frameworks, the asset lifecycle and end-of-life (EOL), configuration and change management, red, blue and purple teaming, application testing and physical penetration testing.
18. Level 18: Timed Mock Exam (60 Questions, 75 Minutes) Timed mock
    [All five domains] A timed mock exam of 60 original scenario questions, weighted by domain, with a 70% pass mark and an explanation for every wrong option, repeating the notice: ISC2 and CC are registered marks of ISC2, Inc.; this course is independent, not affiliated with, endorsed or approved by ISC2, and not official training; the exam outline is ISC2's, free on its website, and is not reproduced here; the exam lasts 2 hours, has 100-125 adaptive items and needs 700 of 1000 to pass; no pass is promised.

Access

The first 2 levels are free with a free account. Every level, the podcast edition and the AI tutor come with All Access at £4.99/month or any Creator plan — see pricing.

Start free →