Cybersecurity Certification Roadmap: CC, Security+, CEH, and CISSP

Step 1: Start with the right level

Think in three stages. Entry level proves you understand security basics: ISC2 Certified in Cybersecurity (CC), Microsoft SC-900, or CompTIA Security+ if you already have some IT background. Practitioner level proves hands-on skills: Security+, CompTIA CySA+ and PenTest+ for analysts and testers, or CEH. Senior level proves experience and management knowledge: CISSP and CISM. Most careers move up these stages over several years.

Entry         ISC2 CC  |  Microsoft SC-900  |  CompTIA Security+
Practitioner  Security+  |  CEH  |  CySA+  |  PenTest+
Senior        CISSP  |  CISM  |  specialist cloud security credentials

Step 2: ISC2 Certified in Cybersecurity (CC)

CC needs no work experience. It is a 2-hour adaptive exam with 100 to 125 questions and a passing score of 700 out of 1000. ISC2 introduced a new exam outline effective September 1, 2026, with five domains: Security Principles (24 percent), Security Governance (17.3), IAM Concepts (20), Networking and Cloud Security Concepts (21.3), and Security Operations and Incident Response (17.3). It suits career changers and students. Check ISC2's site for fees, which were not shown on the exam page.

Step 3: Microsoft SC-900 and CompTIA Security+

SC-900 is a 45-minute fundamentals exam on Microsoft security, compliance, and identity, with a 700 passing score and an updated skills outline effective October 21, 2026. It fits anyone in a Microsoft-centered environment. Security+ is the most common first technical security certification and is covered in its own guide, including the new SY0-801 version expected in November 2026.

Step 4: Certified Ethical Hacker (CEH)

EC-Council's CEH v13 knowledge exam is 125 multiple-choice questions in 4 hours. EC-Council also offers a 6-hour practical exam with 20 challenges, and passing both earns the CEH Master designation. EC-Council recommends two years of IT security experience, and says CEH is approved under US DoD 8140. Training prices on the official page start from about 1,699 USD, so compare with free hands-on practice before committing. Practical offensive skill is better shown through labs and portfolios than by any single exam.

Step 5: CISSP for experienced professionals

CISSP is the best-known senior credential and has its own guide. It requires five years of paid experience in two or more domains, so most people reach it after several years in the field, and the Associate of ISC2 path lets earlier candidates pass the exam first.

Step 6: Build a sensible path

A common path for a newcomer is CC or Security+, then a role-aligned credential such as CySA+ for the blue team or PenTest+ for testing, with a cloud security credential if your employer uses AWS, Azure, or Google Cloud, and then CISSP when you meet the experience requirement. Pair every exam with projects: a home lab, a write-up of an incident you investigated, or contributions to detection rules. Employers hire for skills, and certifications help prove them.