Skip to content

ISC2 CC Study Plan

Four weeks at 5-6 hours per week, assuming you are starting from little or no security background. The free ISC2 self-paced course maps to these domains and is the best primary source.

Week 1: Security principles

  • Register for the free ISC2 training and download the exam outline
  • The CIA triad, with an example of a breach of each
  • Authentication, authorization, accounting, non-repudiation
  • Privacy and personally identifiable information
  • Risk vocabulary: asset, threat, vulnerability, likelihood, impact, risk
  • Risk treatment: avoid, mitigate, transfer, accept, and an example of each
  • Control types: technical, administrative, physical
  • Control functions: preventive, detective, corrective, deterrent, compensating
  • The ISC2 Code of Ethics canons, in order
  • Governance documents: policy, standard, procedure, guideline, regulation
  • Review Notes: notes/01-security-principles.md

Week 2: Network security

  • OSI model layers and what each does; TCP/IP model mapping
  • IP addressing, ports, and the common port numbers
  • Protocols: TCP versus UDP, HTTP and HTTPS, DNS, DHCP, SMTP, SSH, FTP and SFTP
  • Network types: LAN, WAN, VLAN, VPN, wireless
  • Devices: switch, router, firewall, proxy, load balancer, and what each does
  • Threats: DoS, DDoS, on-path, spoofing, phishing, malware families, insider threat
  • IDS versus IPS
  • Segmentation, DMZ, network access control, zero trust
  • Cloud service models and deployment models
  • Shared responsibility, SLAs, and managed service providers
  • Review Notes: notes/02-network-security.md

Week 3: Access control and security operations

  • Physical access controls and their purposes
  • Least privilege, need to know, separation of duties, job rotation
  • Access control models: DAC, MAC, RBAC, ABAC, rule-based
  • The identity lifecycle: provisioning, review, deprovisioning
  • Privileged access management
  • Data handling: classification, labeling, retention, destruction
  • Encryption: symmetric, asymmetric, hashing, and what each is for
  • Logging, monitoring, and what a SIEM does
  • Configuration management, baselines, patching, change management
  • Security policies and awareness training
  • Review Notes: notes/03-access-control.md and notes/04-security-operations.md

Week 4: BC, DR, IR, and review

  • Incident response phases, in order
  • The incident response team and plan
  • Business impact analysis and the continuity plan
  • Disaster recovery: RTO, RPO, backup types, recovery sites
  • Distinguish BC, DR, and IR with a scenario for each
  • Review Notes: notes/05-bcdr-and-incident-response.md
  • Work every scenario in scenarios.md
  • Write out every definition pair listed in the readiness check below
  • Two full timed practice exams; review every wrong answer
  • Light review the day before; do not learn new material

Readiness check

Define each pair cleanly, with an example, without notes:

  • Threat versus vulnerability versus risk
  • Authentication versus authorization versus accounting
  • Preventive versus detective versus corrective versus deterrent versus compensating
  • Technical versus administrative versus physical control
  • Least privilege versus need to know
  • DAC versus MAC versus RBAC versus ABAC
  • Symmetric versus asymmetric encryption versus hashing
  • IDS versus IPS
  • RTO versus RPO
  • Business continuity versus disaster recovery versus incident response
  • Policy versus standard versus procedure versus guideline