Certified Chief Information Security Officer credential artwork

Certified Chief Information Security Officer (CCISO) (712-50) Exam Guide

Validates knowledge of security governance, executive leadership, program management, core security competencies, and strategic planning, finance and procurement.

CCISO tests how a security executive makes decisions: governance, risk and audit, leading people, running the program, the technical areas a CISO oversees, and budgets and contracts. Use your experience, cover the domains you have not led yourself, and practice choosing the first or best executive action.

Understand the exam

Syllabus

1Governance, risk, compliance and audit management15%
  1. Governance
  2. Risk Management
  3. Compliance
  4. IT Audit Management

Example scenario: A regulator announces new breach-reporting rules that take effect in six months. How would you assess the gap and report it to the executive team?

2Organizational executive leadership16%
  1. Role of Leader
  2. Leading Organization
  3. Leading People, Building Teams, and Mentoring Future Leaders
  4. Leading Self

Example scenario: The board asks why security needs a larger budget after a year without incidents. How would you make the case?

3Information security controls, security program management and operations12%
  1. Information Security Management Controls
  2. Security Program Management
  3. Security Program Operations

Example scenario: A new vendor platform needs to go live next quarter. How would you scope the security work, budget it and track it to completion?

4Information security core competencies46%
  1. Access Control
  2. Social Engineering, Phishing Attacks, Identity Theft
  3. Physical Security
  4. Disaster Recovery and Business Continuity Planning
  5. Firewall, IDS/IPS and Network Defense Systems
  6. Wireless Security
  7. Virus, Trojans and Malware, and other Malicious Code Threats
  8. Secure Coding Best Practices and Securing Web Applications
  9. OS Hardening
  10. Encryption Technologies
  11. Vulnerability Assessment and Penetration Testing
  12. Threat Management
  13. Incident Response and Computer Forensics

Example scenario: A ransomware attack hits a regional office on a Friday night. What decisions must you make in the first hour, and who needs to be involved?

5Strategic planning, finance, procurement and third-party management11%
  1. Strategic Planning
  2. Finance
  3. Procurement
  4. Third Party Management

Example scenario: A cloud provider's contract renewal removes a security-reporting clause. How would you respond before signing?

CCISO Blueprint v3 · Blueprint v3, exam 712-50

Format

Questions
150
Duration
2h 30m
Passing score
60–85%
Delivery
Test centre or online
Languages
English

Question types

Multiple choice. Read a scenario and select the single best answer from the options shown.

CertUp example

A vendor that hosts customer data reports a breach on its side. As CISO, what should you do first?

  1. Terminate the vendor contract
  2. Invoke the incident response and notification process and request the vendor's findings
  3. Wait for the vendor's final report before telling anyone
  4. Ask the vendor to delete the affected data
Show answer

B. The CISO activates the response process first so impact, legal duties and customer notification can be assessed. Ending the contract or waiting comes later.

Eligibility and booking

Approval required before the exam

5 years of information security management experience

Required

EC-Council checks your work history with verifiers before you can buy an exam voucher. Years can overlap across domains.

With official CCISO training5 years in 3 of the 5 domains. No application fee.
Without official training5 years in each of the 5 domains, plus a $100 application fee.

Without training, an information security degree can waive up to 3 years in a domain: a PhD 3 years, a related master's or bachelor's 2 years, and a CPA, MBA or finance master's 3 years for the finance domain. With CCISO training and 2 years in one domain, you can take the Associate CCISO exam instead.

Send the eligibility application with your work history and verifiers. Once EC-Council approves it, you receive instructions to buy the voucher. Vouchers are valid for one year.

CCISO eligibility applicationCCISO exam information

Make a study plan

Send your eligibility application before you start studying in depth. Then read the blueprint and mark the domains you have not led yourself.

Most candidates spend 40–80 hours. Plan for the low end if you already lead most of the five domains; add time for domains outside your own experience, such as finance or procurement.

8 weeksto be ready
  1. 1Understand the examRead the syllabus and format, check you’re eligible and pick a target date.3 h
  2. 3Learn the core conceptsWork through one main course or book, topic by topic.36 h
  3. 4Practice with mock examsTake timed practice tests and review every mistake.18 h
  4. 5Prepare for exam dayBook the exam and check the ID and delivery rules.3 h

Learn the core concepts

Use official training or a study guide that covers all five domains. Spend most of your time on the domains you have not run yourself.

Best official courseCCISO single video courseEC-Council · $2,499 · 1 year access, exam includedBest live boot campCCISO Certification Boot CampTraining Camp · $3,395 · 5 days, online or in person
See all 2 CCISO courses →

Answer as the executive. Choose the action a CISO takes: set direction, inform the right people and manage the risk, rather than doing the technical work yourself.

Practice with mock exams

Use EC-Council's own practice assessments or a well-reviewed question bank, and check any answer that looks wrong against the blueprint or your study guide.

CCISO AssessmentEC-Council · Free · contact form requiredCCISO v4 Exam PrepEC-Council · $149 · 1 yearCCISO Certified Chief Information Security Officer All-in-One Exam GuideMcGraw Hill · $90 print · $81 eBook · one-time
See all 3 CCISO practice tests →

Are you ready?

  • You can explain why one executive action should come before the others.
  • You score consistently across all five domains, including finance and procurement.
  • You can answer 150 questions in 2.5 hours, about one minute each.

Prepare for exam day

Have a government-issued photo ID that matches your application and your valid voucher.

  • Book your remote-proctored session through the EC-Council exam portal.
  • Run the equipment test on the computer and network you will use.
  • Test alone in a quiet room with a clear desk and your webcam on.
  • Plan for about one minute per question; there are 150 questions in 2.5 hours.

After you pass, your digital certificate arrives within 7 working days.

CCISO handbook

Advice from exam takers