ISC2 Certified in Cybersecurity Roadmap

Build the vocabulary used to make every later decision.

• Apply confidentiality, integrity, availability, authentication, authorization, accounting, non-repudiation, and privacy to simple scenarios.
• Trace risk from context and identification through assessment, treatment, monitoring, and communication.
• Separate regulations and laws from frameworks, policies, standards, procedures, and guidelines.
• Classify technical, administrative, and physical controls and explain why layered controls are needed.
• Practice due care, due diligence, professional conduct, evidence integrity, authorized disclosure, and the ISC2 Code of Ethics.
• Reject any study method based on live, recalled, leaked, copied, or dump questions.

Connect security activity to leadership, obligations, and organizational resilience.

• Explain the purpose and importance of Governance, Risk, and Compliance and how frameworks and tools support—not replace—accountability.
• Distinguish business continuity, which sustains critical operations, from disaster recovery, which restores technology and data.
• Build awareness around social engineering, phishing, password protection, reporting, and leadership-supported culture.
• Define meaningful metrics and Key Risk Indicators with owners, sources, thresholds, quality checks, and decisions.
• Use dashboards, scorecards, and reports to communicate effectiveness without hiding missing data or gaming measures.
• Run discussion-only tabletop exercises in fictional scenarios with no production impact.

Treat access as a lifecycle, not a one-time login.

• Define roles and execute provisioning, review, role change, and deprovisioning.
• Use frameworks and tools to automate approved policy while preserving review, exception handling, and audit.
• Apply least privilege to people, administrators, contractors, applications, and service identities.
• Apply separation of duties to sensitive approval and transaction paths.
• Differentiate role-based access control, discretionary access control, mandatory access control, and other models by who sets policy and how access is decided.
• Test successful and denied access and remove orphaned or accumulated privileges.

Reason from communication requirements and trust boundaries.

• Review OSI and TCP/IP concepts, IPv4, IPv6, VPNs, ports, protocols, applications, and firewall decisions.
• Identify wireless risks involving Wi-Fi and Bluetooth and the security needs of industrial, embedded, and IoT systems.
• Use firewall zones, VLANs, and micro-segmentation to constrain paths and lateral movement.
• Apply defense in depth so one control failure does not expose the entire environment.
• Apply Zero Trust by evaluating identity, device, context, and least privilege instead of trusting internal location.
• Learn cloud characteristics, IaaS/PaaS/SaaS, deployment models, and the shared security model.

Turn data and controls into defensible daily operations.

• Classify and label data; distinguish masking and sanitization; compare symmetric, asymmetric, hashing, and planning for quantum-resistant cryptography.
• Collect and protect logs, create event use cases, prioritize and correlate alerts, and avoid treating every alert as proof.
• Use threat-actor context, cyber threat intelligence, and threat frameworks with explicit confidence and relevance.
• Follow and exercise an incident response plan, including data-handling requirements and tabletop or simulation exercises.
• Manage asset lifecycle, end-of-life technology, configuration baselines, approved changes, validation, and rollback.
• Differentiate blue, purple, and red teaming; vulnerability scanning; static and dynamic analysis; threat modeling; and physical testing. Perform technical or human testing only with explicit authorization.
• Complete three projects, review 40 cards, and answer the exact 12/9/10/11/8 approximation.