If you have ever searched for a first cybersecurity credential, the ISACA Cybersecurity Fundamentals Certificate probably showed up next to Security+ and ISC2 CC. It had a quiet appeal: no work-experience requirement, a two-hour exam, and a price well under what the bigger names charge. That window is now closing, and it closes on a date you can put on a calendar.
ISACA has told candidates that the last day to buy the exam or its exam prep is December 1, 2026, and that the whole program is sunset on June 1, 2027. The timing also overlaps with CompTIA’s rollout of the new Security+ version, which we covered in our guide to Security+ SY0-801 versus SY0-701. This post sticks to the ISACA side: what is confirmed, what the exam asks for, what its apparent replacement looks like, and who should still buy before the cutoff.
What ISACA Has Actually Confirmed About the Sunset
The sources on this are uneven. A few training blogs repeat the dates, but the one that matters is ISACA’s own certificate page, so that is what the facts below are built on.
The Two Dates That Matter
ISACA’s Cybersecurity Fundamentals Certificate page states both deadlines directly:
- December 1, 2026: the last day to purchase the exam or ISACA’s exam prep products.
- June 1, 2027: the date the program is retired.
The gap between those two dates is deliberate. Registration eligibility on this exam lasts six months from the day you pay, so a purchase made close to December 1 would run out right around the sunset. ISACA does not spell out whether a late purchase is guaranteed that full window, so if you plan to buy near the deadline, confirm the sit-by date in writing before paying.
What Happens to People Who Already Hold It
ISACA’s page does not state a validity period or renewal rule for the certificate, and it says nothing about holders losing the credential at sunset. Training providers describe it as a certificate with no expiration date. The practical risk for holders is not losing the credential. It is that a retired credential carries less weight with a hiring manager each year after the sunset.
One thing that can confuse the picture: ISACA keeps a separate retired credentials page that lists CSX-P (retired April 30, 2023) and both ITCA and CET (retired January 6, 2026). The Cybersecurity Fundamentals Certificate was not on that list when we checked, because it is sunsetting on a schedule rather than already gone.
What the Exam Covers and What It Costs Right Now
Because the exam is still on sale, the format is still the one you would sit. Here is what ISACA’s page lists.
Format, Fees, and Scheduling Rules
- Delivery: online, remotely proctored, computer-based.
- Length: two hours. ISACA does not publish a question count.
- Question types: multiple choice plus performance-based questions in a virtual lab environment.
- Passing score: 65 percent or higher.
- Prerequisites: none.
- Fee: US$120 for ISACA members, US$144 for non-members.
- Scheduling: you can book as early as 48 hours after paying, appointments open up to 90 days ahead, and rescheduling is free if you do it at least 48 hours out and inside your six-month eligibility window.
The fee is the headline for most people. At $144 for a non-member it sits below the usual price of a mainstream entry-level security exam, which is a real draw for career changers on a budget.
The Four Domains and Their Weights
The blueprint is built around four areas, and the weighting tells you where to spend your study hours. Securing Assets is more than a third of the exam by itself.
| Domain | Weight |
|---|---|
| Securing Assets | 35% |
| Information Security Fundamentals | 27% |
| Security Operations and Response | 20% |
| Threat Landscape | 18% |
Weights are as published on ISACA’s certificate page in November 2026. The performance-based lab questions are the part candidates tend to underestimate, since they test whether you can apply a control, not just name it.
Study Options, and What a Question Bank Can and Cannot Do
ISACA sells three official routes: an online course that earns 9.5 CPE, a lab package that also earns 9.5 CPE and keeps the labs open for six months, and a study guide that the page recommends pairing with the labs. The labs matter because of the performance-based questions above.
A question bank is a supplement to that, not a substitute. The ISACA Cybersecurity Fundamentals practice set on DirectCertify has 67 questions (61 single choice, 6 multiple choice) with a 120 minute timer, so it works for drilling the four domains and getting used to the pacing. It cannot reproduce the virtual lab portion of the real exam, and ISACA’s official count of questions is not published, so treat the bank as a way to find weak domains rather than a mirror of the test.
Where CCS Fits, and What Nobody Has Published Yet
ISACA’s newer entry-level credential is the Certified Cybersecurity Specialist, or CCS. It is the obvious thing to compare against, but it is not yet a finished product, and that is the key fact for anyone deciding today.
What ISACA Says About CCS So Far
ISACA’s CCS page still labels the credential as beta. What it does state:
- Audience: a vendor-neutral credential for early-career professionals and IT staff moving into cybersecurity.
- Practice areas: Cybersecurity Principles and Techniques, Security Operations, and Secure By Design, with no weights given.
- Prep materials: listed as arriving on December 1 (the page does not give the year, so read it as December 2026), including an online review course, a question database of 300-plus questions on a 12-month subscription, and a review manual in digital and print.
- Exam registration: opens January 5, 2027.
What Is Still Missing
The CCS page lists no final price, exam format, duration, domain weights, prerequisites, or renewal terms. A training blog reported a beta price of US$199 with the review manual included, but ISACA’s own page does not show a price, so do not budget around that number yet. Neither ISACA page describes CCS as a replacement. The link between the two credentials is an inference from timing and audience: one stops being sold on December 1 for the same kind of candidate that the other targets, with registration opening five weeks later.
That five-week gap is worth noticing. Anyone who buys nothing before December 1 and waits for CCS has no official ISACA entry exam to sit between December 1 and January 5.
Buy It, Wait for CCS, or Pick a Different Starter Certification?
The right answer depends less on the technology and more on your deadline and your budget.
When Buying Before December 1 Makes Sense
- You need a dated, low-cost security credential on your resume inside the next six months.
- Your employer or training program reimburses ISACA exams or counts CPE, and the 9.5 CPE courses are useful to you.
- You already started studying the four domains and would otherwise be throwing that work away.
When Waiting for CCS Is the Better Call
If you are not in a hurry, waiting avoids putting money into a credential that employers will see as retired a few months later. The cost of waiting is real uncertainty: no published price, and no exam format. If the timeline matters more than the brand, this is not your option.
The Two Alternatives Most Beginners Compare It With
ISC2’s Certified in Cybersecurity is the closest peer by audience. ISC2 lists a US$50 annual maintenance fee for members who hold only the CC, according to its annual maintenance fee page, and its free One Million Certified in Cybersecurity enrollment stopped taking new sign-ups on May 20, 2026. Our write-up of the 2026 ISC2 certification changes covers what changed for CC candidates.
CompTIA Security+ is the other, and it costs noticeably more per attempt than either ISACA exam, so check CompTIA’s store for the current voucher price before you plan around it. Its biggest advantage is that employers recognize it everywhere, and the SY0-801 version arrives this month.
What a Beginner Security Credential Does for Your Pay
An entry-level certificate does not set your salary by itself, and no one should read it that way. What it does is help you get interviews for roles where the money is. The U.S. Bureau of Labor Statistics reports a median annual wage of $129,180 for information security analysts in May 2025, with the lowest 10 percent earning under $75,090 and the highest 10 percent above $199,850. BLS projects 21 percent employment growth for the occupation from 2025 to 2035, with about 14,100 openings a year, in its Occupational Outlook Handbook entry for information security analysts.
The gap between the bottom and top of that range is the point. A fundamentals certificate is a way into the lower end of the pay range, and the climb after that depends on hands-on experience and the next credential, not on the first one.
DirectCertify is an independent certification prep provider and is not affiliated with, endorsed by, or sponsored by ISACA. Exam fees, sunset dates, and the CCS launch details can change, so confirm them on ISACA’s official certification pages before you pay for anything.
