ISACA has set an end date for its Cybersecurity Fundamentals Certificate. The last day to buy the exam or exam prep is 1 December 2026, and the program is sunset on 1 June 2027. This page sets out those dates, what ISACA sells for the exam, and how to decide whether to start now.
TL;DR
- 1 December 2026 is the last day to purchase the Cybersecurity Fundamentals exam or exam prep, according to official ISACA documentation.
- 1 June 2027 is the date the Cybersecurity Fundamentals Certificate program is sunset.
- ISACA points candidates to its newest certification, the Certified Cybersecurity Specialist (CCS), which has an upcoming beta program.
- ISACA recommends buying the Cybersecurity Fundamentals Lab Package as a companion to the Study Guide; the labs stay accessible for six months after purchase.
- ISACA's Exam Candidate Guide covers registration, scheduling, rules, scoring, the retake policy and proctoring.
What exactly is ending, and when?
Official ISACA documentation states that the Cybersecurity Fundamentals Certificate program will be sunset on 1 June 2027. To earn the certificate, you must purchase the exam or exam prep by 1 December 2026. After that date the exam and the official preparation materials can no longer be bought.
If you already hold the certificate, nothing in ISACA's notice says it stops being yours. If you do not, the deadline is the number that matters: it is the day your options narrow, not the 2027 date.
What does ISACA sell to prepare for the exam?
ISACA's resources page lists the study products for the exam:
- Cybersecurity Fundamentals Study Guide, the written preparation material.
- Cybersecurity Fundamentals Lab Package, an online virtual training environment where you practise real-world technical tasks. Once purchased, the labs are accessible for six months, any time. ISACA states: "We recommend purchasing the Cybersecurity Fundamentals Lab Package as a companion to this study guide."
- A self-guided online course that blends knowledge and hands-on application.
ISACA sets the prices in its store and they can change, so check the store for current prices before you decide. ISACA also publishes an Exam Candidate Guide that explains exam registration, scheduling, preparation, rules, administration, scoring, the retake policy and proctoring. Read it before you book.
A practice question from our bank
The question below comes from the CertCompanion practice bank for this exam. It tests sequencing in incident response: the next phase after containment.
A hospital cybersecurity team responds to a ransomware incident where attackers encrypted patient databases and demanded payment. The incident response team has completed initial containment by isolating affected systems from the network. The team must now remove the ransomware, identify the initial infection vector, close the security vulnerability, and verify system integrity before restoration. According to incident response best practices, which phase should the team execute next after containment? (Select one!)
- A. Detection phase by implementing enhanced monitoring to identify similar future attacks
- B. Recovery phase by restoring systems from clean backups and returning to normal operations
- C. Lessons Learned phase by documenting the timeline and updating incident response procedures
- D. Eradication phase by removing malware, identifying root cause, and closing vulnerabilities
Show the answer and the reasoning
Correct answer: D. Eradication phase by removing malware, identifying root cause, and closing vulnerabilities
Eradication phase is correct because it follows containment in the standard incident response lifecycle and focuses on removing the threat from the environment, identifying and closing vulnerabilities that enabled the attack, and ensuring the attacker's access has been completely eliminated. Eradication includes removing malware artifacts, patching vulnerabilities, changing compromised credentials, and addressing the root cause before proceeding to recovery. Attempting recovery before eradication risks reinfection if malware remnants persist or if the attacker maintains access through the original vulnerability. Recovery phase comes after eradication and involves restoring systems from clean backups, validating integrity, and returning to normal operations, but executing recovery before eradicating the threat could result in immediate recompromise. Lessons Learned is the final phase after recovery is complete and involves post-incident review, documentation, and process improvements. Detection describes the initial identification of the incident and is not applicable as the next phase after containment has already occurred.
The mistake this question exposes is sequencing. Candidates who know incident response concepts can still pick a step that belongs to an earlier or later phase, so read the scenario's current state before choosing the next action.
| ITCA question bank | |
|---|---|
| Questions | 596 |
| Single-answer | 543 |
| Select-all-that-apply | 53 (9%) |
| Median explanation length | 98 words |
Should you start now or look at the CCS?
Decide with the dates, not with a guess about the market:
- If you can finish preparing and sit the exam, you must buy by 1 December 2026. Buy the exam and the preparation you need before that date, and book the exam as early as you can.
- If you are starting from zero and the timeline is tight, look at ISACA's page for the Certified Cybersecurity Specialist (CCS), its newest certification, and its beta program, and compare what each asks of you.
- If you only want practice, you can work through the CertCompanion practice questions at any time. They are free to start and do not depend on ISACA's purchase window.
For other ISACA certifications, see the ISACA exams hub.
Frequently Asked Questions
Can I still register for the ISACA Cybersecurity Fundamentals Certificate? Yes, until 1 December 2026, which ISACA gives as the last day to purchase the exam or exam prep. The program is sunset on 1 June 2027. Check ISACA's official documentation for any change to these dates.
What is the Certified Cybersecurity Specialist (CCS)? ISACA describes it as its newest certification, with an upcoming beta program. See ISACA's CCS page for the details; this page does not describe its content or requirements.
Should I buy the Lab Package? ISACA recommends it as a companion to the Study Guide, and the labs are accessible for six months after purchase. Because the purchase deadline is 1 December 2026, plan the six months around when you intend to sit the exam.
Where do I find registration, scoring and retake rules? In ISACA's Exam Candidate Guide, which covers exam registration, scheduling, preparation, rules, administration, scoring, the retake policy and proctoring.
Are there free practice questions? Yes. You can start with 30 free practice questions at the CertCompanion exam page below.
The Cybersecurity Fundamentals Certificate has a hard end date. If you want it, the date to plan around is 1 December 2026, and the date to remember afterwards is 1 June 2027.
Start with 30 free practice questions at CertCompanion and find out where your gaps are before you buy anything.
Checked against official ISACA documentation. Last verified 2026-10-27.