Read, apply, then check.
Continue a lesson with one of nineteen guided cases. Each names the free coverage added, the work still missing and any paid requirement.
Think in assets, objectives and risk
Build the language of security, connect it to decisions, and make claims that the evidence can support.
Everyday computing, information and assets
Start here
02Confidentiality, integrity, availability, privacy and AAA
Start here
03Governance, controls, frameworks and policies
Start here
04Professional conduct, due care and due diligence
Start here
05Risk concepts, scenarios, assessment and treatment
Start here
People, resilience and useful evidence
Explore behaviour, disruption and measurement through a small fictional service.
Control identity and access
Separate identity evidence from permissions, then follow access from joining to leaving.
Connect systems safely
Understand names, addresses, trust boundaries, wireless systems and cloud responsibilities.
Protect data and understand activity
Choose suitable protection, interpret records and use threat information without overstating what it proves.
Encryption, hashing, signatures and quantum-resistant cryptography
Protect and observe
16Classifying, labelling, masking, retaining and sanitizing data
Protect and observe
17Logging, monitoring, SIEM, correlation and triage
Protect and observe
18Threat actors, threat intelligence and ATT&CK
Protect and observe
Respond, maintain, test and apply AI
Use evidence to respond and improve, then apply the same foundations to AI systems.
Incident response, evidence and tabletop exercises
Connect the domains
20Asset lifecycle, configuration, change and patch management
Connect the domains
21Security testing, team exercises and threat modelling
Connect the domains
22AI fundamentals and applications across the CC domains
Connect the domains
Build an information security management system
Connect context, leadership, risk, support and operation in the selected ISO/IEC 27001:2022 route.
What an ISMS is, the standards family and PDCA
From controls to a system
24Organizational context, scope, parties, leadership and policy
From controls to a system
25ISMS objectives, risk treatment, applicability and controls
From controls to a system
26Support, competence, communication, documented information and operation
From controls to a system
Evaluate, improve and prepare
Learn audit and corrective-action reasoning, understand the two credential routes, and turn practice into feedback.
Performance evaluation, audit types and management review
Evidence before confidence
28Nonconformity, correction, causes, corrective action and improvement
Evidence before confidence
29The CC-first and selected PECB Foundation routes
Evidence before confidence
30Practice, feedback and a fictional learning portfolio
Evidence before confidence
Choose your path.
Start from the beginning
An entry route for someone new to IT security. Follow the service, learn the distinctions and explain decisions before progressing to the complete CC path.
Follow this pathPrepare for ISC2 CC
Move from computing foundations into the five CC domains, then connect them through incidents and AI applications. Complete lesson 22 before the readiness checkpoint. Lesson order supports a beginner; official objectives remain the scope reference.
Follow this pathContinue to PECB ISO/IEC 27001:2022 Foundation
Connect security foundations to context, planning, operation, evaluation and improvement. These free lessons support preparation; complete the selected official PECB course and activities for exact requirements, provider terminology and feedback.
Follow this pathExplore one fictional service
Follow Example Studio’s booking service from assets and risks to access, data, incidents, recovery and improvement. Use it as a discovery route or portfolio project alongside either exam path. Every example and proposed record is fictional.
Follow this path