Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
A reference guide to ISACA's hands-on security operations certification as of 2026. It covers the five domains, the 4-hour exam and its lab section, who the credential is built for, the analyst jobs it maps to, and how CCOA compares to CySA+ and the EC-Council CSA.
CCOA is ISACA's hands-on security operations certification, launched in January 2025 for analysts who work threats, alerts and incidents every day.
It validates the technical skills to evaluate threats, identify vulnerabilities, and recommend countermeasures that stop incidents before they spread. Unlike CISM and CISA, which are multiple choice only, CCOA follows its 115 multiple-choice questions with 25 performance-based questions in a lab, so you have to show the work in tools like Wireshark, Kibana and Security Onion.
There is no experience requirement to certify. You pass the exam, pay a $50 application fee and apply within five years. CCOA is issued and maintained by ISACA, the association behind CISA, CISM, and CRISC.
Networking, systems and endpoints, and applications. 25% of the exam.
Governance, compliance, and risk across cloud, data, and networks. 20%.
Threat actors, attack vectors, and exploit techniques. 10%.
Logs, alerts, forensics, and malware and packet analysis. The heaviest domain at 34%.
Controls, identity and access, and vulnerability management. 11%.
Four things that set CCOA apart for analysts who work in security operations in 2026.
After 115 multiple-choice questions, the CCOA exam moves into a lab for 25 performance-based questions. You work in the tools a SOC uses, such as Wireshark, Kibana, Security Onion, CyberChef and PowerShell, which makes a pass harder to earn by memorization alone.
Incident Detection and Response alone carries 34 percent of the exam, and Technology Essentials adds another 25 percent. If you are weighing CCOA against CompTIA's analyst exam, our guide to what to take after Security+ covers the CySA+ side of the SOC path.
There is no experience requirement to sit the exam or to certify, though ISACA designed it for analysts with two to three years of experience. Our look at the new certifications worth your time covers where CCOA sits between Security+ and CISSP or CISM.
ISACA does not claim a DoD 8140 mapping for CCOA on its certification page or in the exam candidate guide, so check the current qualification matrix before you count on it for DoD cyber workforce roles. If you need an ISACA credential for a DoD 8140 role, CISM, CISA and CRISC are the ones on the qualification matrix.
CCOA's recognition so far comes from the industry. ISACA reports that it was named Professional Certification Program of the Year in the 2025 Cybersecurity Breakthrough Awards and was a finalist for Best Professional Certification Program in the 2025 SC Awards Europe.
The certification, the exam structure, and how to maintain CCOA, as of October 2026.
CCOA holders usually move in one of three directions: security management, a senior all-round credential, or deeper incident response work. CISM and CISSP both carry five-year experience requirements of their own, so they tend to come a few years after CCOA.
ISACA's Certified Information Security Manager moves you from working incidents to running the security program around them. It requires five years of information security management experience, and ISACA's CCOA launch announcement says CCOA exam passers earn a one-year educational waiver toward CISM.
ISC2's Certified Information Systems Security Professional covers eight domains, from security architecture to software security. It requires five years of paid experience in two or more of those domains and suits analysts moving toward architecture or leadership.
EC-Council's Certified Incident Handler, exam 212-89, goes deeper on the incident handling process that the CCOA Incident Detection and Response domain introduces. It fits analysts who end up owning response rather than just triage.
CCOA sits at the analyst stage. It builds on a networking and security foundation and opens paths into security leadership, incident response and forensics, or threat intelligence and testing.
Build the baseline
The analyst stage
Two questions to answer before you commit: can you certify, and should you pursue CCOA specifically. Here's a straight answer to both.
You're the candidate ISACA built it for.
You already monitor alerts, read logs, or work vulnerability and incident tickets. Register, pass the exam, pay the $50 application fee and apply, and you hold the full CCOA. Your daily work already covers much of what the lab section asks you to do.
You can still register today.
ISACA sets no experience requirement to sit the exam or to certify, and you have five years from your pass date to apply. The exam still assumes you can work a command line and read network traffic, so build that base first if you don't have it yet.
ISACA names five analyst roles CCOA is built for, and the supporting tasks in its exam outline point to a sixth. These are the jobs where alerts, logs and packet captures are daily work.
Monitors events, triages alerts and decides whether an incident has actually occurred. This is the job the 34 percent Incident Detection and Response domain and ISACA's supporting tasks describe most directly.
Handles confirmed incidents through classification, escalation, containment and documentation, then supports the forensic investigation. The CCOA lab questions test this kind of hands-on work.
Identifies and analyzes the threats and vulnerabilities that apply to the organization, then turns the findings into advice the business can act on and other departments can follow.
Runs scans and assessments, prioritizes what they find and tracks remediation to closure. Greenbone OpenVAS is one of the tools on ISACA's CCOA tools list.
Carries a wider security remit that mixes operations with access control, policy and compliance work, where the CCOA risk and securing assets domains come into play.
Builds and tunes the detection use cases and rule sets a SOC monitors with. Developing them is one of the supporting tasks ISACA lists in the CCOA exam content outline.
All three are analyst credentials built for security operations work, but the exams and the rules around them differ. Here's how they line up.
| CCOA | CySA+ | CSA | |
|---|---|---|---|
| Issuer | ISACA | CompTIA | EC-Council |
| Focus | Hands-on detection, response, and asset security | Detection, vulnerability management, response, reporting | The SOC workflow: logs, SIEM triage, threat hunting, response |
| Experience | None required (2 to 3 yrs suggested) | None required, about 4 yrs recommended | Official training, or 1 yr experience + $100 application |
| Exam Format | 115 multiple choice + 25 performance-based, 4 hours | Up to 85 questions, multiple choice and performance-based, 165 minutes | 100 multiple choice, 3 hours |
| Passing Score | 450 on a 200 to 800 scale | 750 on a 100 to 900 scale | 70% |
| Renewal | 20 CPEs yearly, 120 per 3-yr cycle | 60 CEUs over 3 years | 120 ECE credits over 3 years + $80 annual fee |
| DoD 8140 Approved | No mapping claimed by ISACA | Yes (10 roles, Advanced on 9) | Not on EC-Council's DoD 8140 list |
| Best For | Analysts who want to prove lab skills | SOC analysts and incident responders | Tier I and Tier II SOC analysts |
Pricing and renewal details vary by membership status and can change. If DoD 8140 matters for your job, CySA+ is the one of the three with approval today. Read the full CySA+ guide or the CSA guide for the detail behind each column.
Certification Matchups puts the published facts, strengths and weak spots of two certifications side by side.
Our official ISACA CCOA boot camp covers all five domains in five days, live online or in person, using ISACA's authorized courseware with hands-on labs each day. Your exam voucher, practice questions and a mock exam, exam prep review sessions and a free retake are included. You can take the exam at our onsite PSI testing center at the end of the week, and you get 180 days of one-on-one coaching after class. If you would rather study on your own, the self-paced option bundles ISACA's online review course, digital Review Manual, QAE database and an exam voucher with 365 days of access.
Certification strategy, the SOC analyst path, and how CCOA fits the broader ISACA portfolio.
Where CCOA fits among the newest security credentials, why it targets the SOC skills that Security+ leaves open, and how it sits between Security+ and CISSP or CISM.
Why CySA+ is the usual next step for people heading into security operations, and when SecurityX or another path makes more sense.
The purpose, requirements and value of ISACA's established credentials, from CISA and CISM to CRISC and CGEIT, for anyone planning a longer ISACA path.
ISACA replaces the CISM exam content outline on November 3, 2026. What changes, and how to time the exam if CISM is your step after CCOA.
How ISACA's 20-hour yearly floor and 120-hour three-year cycle compare with ISC2 and CompTIA, and whether one credit can count toward two certifications.
The nine ECIH domains, the 212-89 exam and who the incident handling credential suits, for analysts who want to go deeper on response.
ID rules, break policies, online proctoring and retake waits compared across vendors, including how ISACA's PSI-delivered exams differ from Pearson VUE.
The CCOA job practice is organized into five domains, each carrying its own weight on the exam. Click any domain for what it covers.
The technical base the rest of the exam builds on. Networking covers cloud and computer networking, devices, ports and protocols, network access, network tools, topology, and logical and physical segmentation. Systems and endpoints cover databases, the command line, containerization and virtualization, middleware, and operating systems. Applications cover APIs, automated deployment, cloud applications, and scripting and coding.
The principles half covers compliance, cybersecurity objectives, governance, risk management, roles and responsibilities, and cybersecurity models. The risk half works through the risk that sits in applications, cloud technology, data, networks, the supply chain, systems and endpoints, and web applications.
First, who attacks and how they get in: attack vectors, threat actors and agents, and threat intelligence sources. Then the means and methods: attack types, the stages of a cyber attack, exploit techniques, and penetration testing. It is the lightest domain by weight, and it is where you learn how the attacker behind an alert actually works.
The heaviest domain by a wide margin. Detection covers data analytics, detection use cases, indicators of compromise and attack, logs and alerts, and monitoring tools and technologies. Response covers incident containment and handling, forensic analysis, malware analysis, network traffic and packet analysis, and threat analysis. If your study time is short, this domain and the lab tools are where to spend it.
Controls first: contingency planning, controls and techniques, identity and access management, and the industry best practices, guidance, frameworks and standards behind them. Then vulnerability management as a full cycle, from assessment and identification through remediation and tracking.
Domains and weights reflect the ISACA CCOA Exam Content Outline and the CCOA Exam Candidate Guide currently in effect. ISACA updates its job practices on a regular cycle, so check the outline before you buy study material.
The questions candidates ask most often when researching the Certified Cybersecurity Operations Analyst certification.
CCOA is ISACA's Certified Cybersecurity Operations Analyst certification, launched in January 2025. It validates the technical skills to evaluate threats, identify vulnerabilities, and recommend countermeasures, and it tests them with a hybrid exam that mixes multiple-choice questions with hands-on, performance-based lab questions.
ISACA designed CCOA for cybersecurity analysts with two to three years of experience. It fits SOC analysts, incident response analysts, vulnerability analysts, and information security analysts who work with alerts, logs, and packet captures. It's a weaker fit for people whose security work is mainly governance, audit, or risk.
As of October 2026 the CCOA exam costs $399 for ISACA members and $499 for non-members, plus a $50 application processing fee once you pass and apply for certification. Every retake costs the full registration fee again, and ISACA allows four attempts in a rolling 12-month period.
The CCOA exam runs 4 hours. You answer 115 multiple-choice questions first, then 25 performance-based questions in a lab environment. It's delivered in English at PSI test centers or by remote proctoring. Scores are reported on a scale from 200 to 800, and you need a scaled score of 450 to pass.
No. ISACA sets no experience requirement to sit the exam or to certify. You pass the exam, pay the $50 application fee, and apply within five years of passing. ISACA still aims the exam at analysts with two to three years of experience, so expect it to assume working knowledge of networks, operating systems, and the command line.
The five CCOA domains are Technology Essentials at 25 percent, Cybersecurity Principles and Risk at 20 percent, Adversarial Tactics, Techniques, and Procedures at 10 percent, Incident Detection and Response at 34 percent, and Securing Assets at 11 percent. Incident Detection and Response carries the most weight on the exam.
ISACA publishes a list of the tools CCOA candidates should know, including Wireshark, Security Onion, Kibana, CyberChef, Greenbone OpenVAS, PowerShell, Windows Event Viewer, Windows Defender, CertUtil, and Linux commands for networking, permissions, processes, and files. ISACA also offers a lab orientation so you can see the lab environment before exam day.
CCOA holders earn a minimum of 20 Continuing Professional Education (CPE) hours each year and 120 CPE hours over each three-year reporting period, pay an annual maintenance fee of $45 for ISACA members or $85 for non-members, and adhere to the ISACA Code of Professional Ethics. CPE hours that meet the rules for other ISACA certifications can count toward those too.
ISACA does not claim a DoD 8140 mapping for CCOA. Neither its CCOA certification page nor the exam candidate guide mentions DoD 8140, so check the current qualification matrix before you count on CCOA for a DoD cyber workforce role. If you need an ISACA credential for DoD 8140, CISM, CISA, and CRISC appear on the qualification matrix. See the full DoD 8140 work role paths.
All three are aimed at security operations analysts. CCOA from ISACA pairs 115 multiple-choice questions with 25 lab-based questions over 4 hours. CySA+ from CompTIA is a shorter exam of up to 85 questions over 165 minutes and is approved for 10 DoD 8140 work roles. CSA from EC-Council is 100 multiple-choice questions over 3 hours, built around the SOC workflow.
It depends on how much of the five domains your daily work already covers. Analysts who already work in a SIEM and read packet captures mostly need practice with the lab format. People coming from help desk or systems work need more time on detection and response. A focused boot camp week covers all five domains with hands-on labs.
For analysts who want proof they can do the hands-on work, yes. The 25 lab questions put you in Wireshark, Kibana and similar tools, the exam and application fee together come to $449 for members or $549 for non-members, and ISACA says CCOA exam passers earn a one-year educational waiver toward CISM. If you need a DoD 8140 qualification today, CySA+ is the safer pick.
Whether you're weighing the certification, working out funding, or planning training for a team, tell us where you are and we'll help you map out the right path.