Domain Map and Time Allocation
Key Takeaways
The 2026 CC outline has five weighted domains: Security Principles 24%, Security Governance 17.3%, Identity and Access Management 20%, Networking and Cloud Security 21.3%, and Security Operations and Incident Response 17.3%.
Security Principles is the largest domain and supplies the vocabulary the other four domains assume you already know.
Allocate study time by domain weight first, then redirect hours toward your measured weak areas after a diagnostic.
Security Governance and Security Operations and Incident Response are each 17.3 percent, so they are small by weight but high-yield because their ordering, escalation, and recovery items are easy points once practiced.
A healthy week blends reading, scenario translation, recall drills, and timed mixed sets rather than one domain at a time.
The Five Domains and Their Verified Weights
The CC exam is organized around five domains. Weights shape how many items each area can supply, so they should shape your plan — but a 17.3 percent domain can still decide an item if the question lands on incident ordering or recovery. These weights are confirmed against the ISC2 CC outline effective September 1, 2026 (v01/2026).
| # | Domain | Exam weight |
|---|---|---|
| 1 | Security Principles | 24% |
| 2 | Security Governance (includes BC and DR redundancy, GRC planning, security awareness, and security metrics) | 17.3% |
| 3 | Identity and Access Management (IAM) Concepts | 20% |
| 4 | Networking and Cloud Security Concepts | 21.3% |
| 5 | Security Operations and Incident Response | 17.3% |
Security Principles is the largest domain and the foundation: confidentiality-integrity-availability (the CIA triad), authentication versus authorization, non-repudiation, privacy, governance, risk, the ISC2 Code of Ethics, and security control categories (technical, administrative, physical). The other four domains assume this vocabulary, so weak Domain 1 quietly costs you points everywhere.
Networking and Cloud Security (21.3%) and Identity and Access Management (20%) are close behind — expect many practical items on secure protocols, segmentation, cloud responsibilities, and identity and least privilege. Security Operations and Incident Response (17.3%) covers data security, logging and monitoring, threat intelligence, incident response, asset protection, and security testing. Security Governance (17.3%) covers GRC planning, business continuity and disaster recovery, security awareness, and security metrics; it is intensely practical even at this weight.
A Weight-Based Time Allocation
For a candidate with 60 focused study hours, a defensible first-pass allocation tracks the weights:
| Domain | Weight | Approx. hours |
|---|---|---|
| Security Principles | 24% | 14 |
| Security Governance | 17.3% | 10 |
| Identity and Access Management (IAM) Concepts | 20% | 12 |
| Networking and Cloud Security Concepts | 21.3% | 13 |
| Security Operations and Incident Response | 17.3% | 11 |
This is a starting budget, not a fixed rule. After a diagnostic quiz, move hours toward measured weakness. If you already know CIA, authentication, and policy but miss segmentation and secure protocols, shift time from Domain 1 to Domain 4. If you work in IT support and know networks but find policy and incident concepts new, push hours into Domains 1 and 2.
What Each Domain Feels Like in Questions
| Domain | Common item style |
|---|---|
| Security Principles | Choose the security goal, ethical response, control type, or risk-aware decision |
| Security Governance (BC/DR) and Incident Response | Identify continuity and recovery terms, order response steps, or pick the escalation action |
| Identity and Access Management | Match identity, authentication factors, authorization, least privilege, and account lifecycle |
| Networking and Cloud Security | Identify secure protocols (TLS, SSH), segmentation, cloud shared responsibility, and defensive placement |
| Security Operations and Incident Response | Select data security, logging and monitoring, incident response, asset protection, and testing practices |
The Weekly Mix
Do not read one domain start-to-finish and forget it. Blend four activities every week so concepts stay retrievable under time pressure:
- Read and annotate to build vocabulary and concept boundaries.
- Scenario review to convert terms into workplace decisions (the real skill the exam tests).
- Recall drills to make high-yield facts fast — domain weights, the CIA triad, control categories, business continuity versus disaster recovery.
- Timed mixed sets to rehearse pacing and the no-going-back CAT discipline.
High-Yield Facts Hidden Inside Each Domain
Domain weight tells you how many items to expect, but certain compact facts inside each domain repay memorization far beyond their size because they anchor multiple questions. Drill these to instant recall:
- Domain 1 (Security Principles): the CIA triad; authentication (proving who you are) versus authorization (what you may do) versus accounting/accountability; non-repudiation; the three control categories (technical, administrative, physical); the difference between a risk, a threat, and a vulnerability; risk treatment options — accept, avoid, mitigate, transfer; and the ISC2 Code of Ethics canons in order.
- Domain 2 (Security Governance: BC and DR): business continuity and disaster recovery (subdomain 2.2); GRC planning, security awareness, and security metrics. Incident-response phases are tested in Domain 5.
- Domain 3 (Identity and Access Management): the three authentication factor types (something you know, have, are); least privilege and need-to-know; separation of duties; the access-control models (DAC, MAC, RBAC); the account lifecycle from provisioning to deprovisioning.
- Domain 4 (Networking and Cloud Security): secure versus insecure protocol pairs (HTTPS over HTTP, SSH over Telnet, SFTP over FTP); the OSI versus TCP/IP layers at a high level; segmentation, DMZ, firewalls, VPNs; cloud service and deployment models with shared responsibility; threat actors and their motivations are covered in Domain 5 (subdomain 5.2).
- Domain 5 (Security Operations and Incident Response): data handling and classification; logging and monitoring; threat actors and threat intelligence; the incident response plan and exercises; configuration and change management; asset lifecycle; security testing.
Most candidates who fail do so because Domain 1 vocabulary is shaky, which then drags down items in Domains 3, 4, and 5 that assume those terms. Fix the foundation first.
Scenario: Rebalancing by Evidence
A candidate studies 20 hours and takes a mixed review. They ace definitions but miss items asking for the first incident-response action and items distinguishing authentication from authorization. Their next week should not simply repeat the original table. They should add incident-ordering practice (Domain 5) and account-lifecycle and access scenarios (Domain 3). Domain weights set the budget; missed-question patterns tell you where the next hour pays the most. Treat the domain map like a spending plan — invest most where the exam invests most, but keep a reserve to repair weak decisions before test day.
Source: ISC2 CC Exam Outline effective September 1, 2026 (v01/2026), five domains and weights (outline page, CC Examination Weights), https://www.isc2.org/certifications/cc/cc-certification-exam-outline, checked 2026-10-22.
Match each CC domain to its verified 2026 exam weight.
Match each item on the left with the correct item on the right
Security Principles
Security Governance
Identity and Access Management (IAM) Concepts
Networking and Cloud Security Concepts
Security Operations and Incident Response
A candidate has 60 study hours and no diagnostic data yet. Which initial allocation is most defensible?
Split time evenly, 12 hours per domain, because there are five domains, and treat every domain as equally weighted so the plan stays simple and easy to follow without checking the published outline weights.
Skip Security Governance entirely because it carries only 17.3 percent of the weight, and spend those hours instead on the domain the candidate already finds most interesting, without any diagnostic check first.
Study only Networking and Cloud Security because it is the most technical-sounding domain, and postpone every other domain until the final week so that the hardest material is learned while energy is highest.
Weight time toward Security Principles, Networking and Cloud Security, and Identity and Access Management while still covering Security Operations and Incident Response and Security Governance.
Which activities belong in a healthy weekly CC study mix? Select all that apply.
Select all that apply
Reading and annotating concepts
Scenario review that turns terms into decisions
Recall drills for high-yield facts
Timed mixed question sets
Adjusting your plan to match a rumored public pass rate
Sections you finish are checked off in the contents.