IC Certification

What the Isograd CyberCitizen Credential Actually Is

Isograd CyberCitizen is a cybersecurity-awareness certification administered by Isograd/Tosa. It is aimed at everyday digital users rather than security engineers: the point is to demonstrate that you can recognize risks, protect your accounts and devices, and behave safely online and at work. Tosa currently markets it under the public name Tosa CyberCitizen, while "IC" is simply the shorthand used here on IC Exam Prep. If you are still sorting out terminology, our explainers What Is IC Certification? and What Does IC Stand For? cover the naming in more depth.

This is a skills-based, scored assessment, not a pass/fail gate in the traditional sense. Every candidate who finishes receives a result on a proficiency scale, and the level you reach determines what you receive: a certificate of completion, a certification diploma, or a diploma plus a digital badge. That structure matters for how you plan your preparation, because the goal is not just "passing" but landing in the band that serves your purpose.

Exam Format: 35 Adaptive Questions in 60 Minutes

The certification exam consists of 35 questions with a 60-minute limit. The test is adaptive, meaning the platform adjusts the questions it presents based on how you have been answering. In practical terms, you cannot assume that your neighbor, or a friend who took the exam last month, saw the same items you will.

Questions come in three styles:

• Multiple-choice items that test whether you can identify the safest option or the correct concept.
• Interactive items that ask you to manipulate or arrange elements on screen rather than simply pick a letter.
• In-application items that place you inside a simulated environment, where you act as you would in real software or settings.

The exam is available in English and French. It is closed book and proctored from start to finish, with no breaks and no outside materials permitted. That means no notes, no second device, and no searching mid-exam.

For a realistic sense of how demanding this format feels, see How Hard Is the IC Exam?, and to rehearse the question styles under timed conditions, use the IC practice tests on the main site.

The Four Exam Domains

The official blueprint, a 24-page Tosa CyberCitizen Exam Blueprint, organizes the content into four domains. No percentage weights are published, so you should not assume any domain is smaller or safer to skip. Domain names below follow the blueprint's exact headings, including the comma after "Accounts" in Domain 2.

For a deeper walkthrough of each area, read IC Exam Domains: Complete Guide to All 4 Content Areas. Keep in mind that the learning-lab course does not replace the four formal domains and should not be treated as exhaustive exam coverage; the blueprint is the authoritative scope document.

How Scoring Works: Bands, Not Percentages

Scoring uses item response theory on a 1-1000 proficiency scale. Because the exam is adaptive, your score reflects the difficulty and pattern of the items you answered, not a simple count of correct responses. A score of 600 does not mean you got 60% right. These are scaled proficiency bands, not percentages.

The two thresholds that matter most are 351 (where the certification diploma begins) and 551 (where the digital badge begins). If your goal is something shareable on a professional profile, aim for 551 or above. No official candidate pass rate was verified, so be wary of any site quoting one with confidence; our piece on the IC pass rate explains what can and cannot be said responsibly, and IC Passing Score goes deeper on the bands.

Registration, Packages, and Testing Logistics

Testing runs on the Tosa/Isograd platform and can be taken through approved Tosa centers or by remote proctoring, which uses Integrity Advocate. In the United States, English-language CyberCitizen is also supported at Prometric centers. There is no formal education, experience, training, or age prerequisite specified, but you must present valid photo identification. For the full eligibility picture, see IC Requirements.

The U.S. online store lists these options:

Package inclusions follow whichever product you select, so read the product page before checking out. A full cost comparison, including how to weigh the packages against each other, is in IC Certification Cost.

Remote proctoring requirements

If you test from home, you need a computer, webcam, microphone, and internet connection. The session is monitored throughout and, as noted, there are no breaks. Clear your desk, silence your phone, and test your equipment ahead of time so technical trouble does not eat into your 60 minutes.

Scheduling details and booking windows are covered in IC Exam Dates.

Validity and Retakes: Where the Sources Disagree

This is the area where candidates most often get confused, because Tosa's own materials do not say exactly the same thing everywhere.

• The exact CyberCitizen blueprint and the directly retrieved U.S. credential page specify three-year validity, with retesting used for renewal or score improvement. That U.S. page also specifies a minimum 24-hour interval between retakes.
• A more generic Tosa FAQ describes lifetime certification with scores becoming outdated after three years, no minimum retake waiting period, and a 551 minimum for other certifications including digital literacy.

How Much Preparation Time to Plan For

Two different time figures circulate, and they describe different things. The credential page recommends around 150 hours of training and practice if you want to reach Productive or higher. The public CyberCitizen Learning Lab course, by contrast, estimates 25-40 hours to complete. These are preparation recommendations, not admission requirements, and neither should be confused with the 60-minute exam itself.

The gap tells you something useful: finishing a course is not the same as being ready to score in the badge-earning bands. Someone who already uses password managers, spots phishing instinctively, and keeps devices patched may need far less time than a beginner. Someone starting from scratch should lean toward the higher end. Our IC Study Guide lays out a full plan, and IC Training compares the learning options.

Who Benefits From This Certification

Because the credential targets general cyber hygiene rather than a technical specialty, it suits a broad audience: administrative and office staff, students entering the workforce, employees in organizations that want a documented awareness baseline, and job seekers who want a verifiable signal of digital safety skills. Employers do not typically hire "CyberCitizens" as a job title; instead, the certification supports roles where careful handling of data and accounts is expected, and it can strengthen a resume for general office, support, and entry-level positions.

Be realistic about earning claims: this is an awareness credential, and no salary figures were verified for it. If you are weighing the investment, read Is the IC Certification Worth It? and browse IC Jobs for how the credential fits into hiring conversations, and IC Salary Guide for a careful look at what can and cannot be claimed about earnings.

Scheduling Your Prep Around the Domains

Since the blueprint gives no weights, split your time roughly evenly, but sequence the domains deliberately. Domain 1 comes first because its vocabulary is assumed everywhere else. Domain 2 deserves the most hands-on practice because in-application questions reward real familiarity with settings and tools.

A compact reference for the final days is the IC Cheat Sheet, and you can keep sharpening with the practice test site.

Frequently Asked Questions