- What This Cheat Sheet Covers (and the IC Name Issue)
- Exam Snapshot: Format, Timing, and Language
- Scoring Bands: What 351 and 551 Really Mean
- The Four Domains at a Glance
- Domain 1: Understanding the Cybersecurity Ecosystem
- Domain 2: Securing Data, Accounts, and Digital Devices
- Domain 3: Adopting Secure Digital Practices
- Domain 4: Protecting Against Cyber Threats and Digital Risks
- Registration and Price Table
- Test-Day Rules and Proctoring
- Validity and Retake Terms: Where Sources Conflict
- A Domain-Ordered Prep Schedule
- Frequently Asked Questions
- The certification exam has 35 adaptive questions and a 60-minute limit, in English or French.
- Scores run 1-1000; 351 earns the diploma, while 551 or higher also unlocks a Credly digital badge.
- Four unweighted domains are tested, and no percentage weights are published, so study all four evenly.
- The U.S. store lists packages from USD 109 (exam plus proctoring) up to USD 235 (course plus two practice assessments).
What This Cheat Sheet Covers (and the IC Name Issue)
This page condenses the facts you need on exam week into one scannable review. It covers Isograd CyberCitizen, a digital-citizenship and cybersecurity-awareness certification administered by Isograd/Tosa. The public brand today is Tosa CyberCitizen, and "IC" is simply the identifier used on this site. If you see a different credential elsewhere that happens to share those two letters, none of its details apply here.
If you are brand new and want the naming background first, the explainers on what IC certification is and what IC stands for cover it. For a deeper study plan, pair this sheet with the IC study guide. When you want to test yourself under realistic conditions, the IC practice tests are the quickest way to find weak spots.
Exam Snapshot: Format, Timing, and Language
| Item | Must-Know Fact |
|---|---|
| Administering body | Isograd/Tosa |
| Questions | 35, adaptive |
| Time limit | 60 minutes |
| Question types | Multiple-choice, interactive, and in-application |
| Languages | English and French |
| Scoring model | Item response theory on a 1-1000 scale |
| Prerequisites | No formal education, experience, training, or age prerequisite specified; valid photo ID required |
| Open book? | No. Closed book and proctored throughout |
What "adaptive" means for you
Because the exam is adaptive, the questions you see respond to how you are performing. You cannot reliably count how many "hard" items you have faced and infer your result, so do not try. Treat each question as independent, answer it as well as you can, and keep an eye on the clock: 60 minutes across 35 questions leaves roughly 1 minute 43 seconds per item on average.
The three question styles
- Multiple-choice: Scenario or concept questions where you pick the best answer. Expect plausible distractors, such as options that sound secure but miss the actual risk.
- Interactive: Tasks where you manipulate or arrange elements on screen instead of just selecting a letter.
- In-application: Questions where you perform an action inside a simulated application or settings screen, so recognizing where a privacy or security setting lives matters as much as knowing the theory.
Because of the in-application format, memorizing definitions alone is a weak strategy. Spend time actually opening the account-security, privacy, and update settings on your own phone and computer so the menus feel familiar. For a realistic read on how demanding this combination is, see how hard the IC exam is.
Scoring Bands: What 351 and 551 Really Mean
The score is a scaled proficiency measure on a 1-1000 range, produced through item response theory. It is not a percentage of questions answered correctly, so you should never convert a score into "I got X out of 35."
| Level | Score Range | What You Receive |
|---|---|---|
| Beginner | 1-350 | Certificate of completion |
| Basic | 351-550 | Certification diploma |
| Productive | 551-725 | Diploma plus Credly digital badge |
| Advanced | 726-875 | Diploma plus Credly digital badge |
| Expert | 876-1000 | Diploma plus Credly digital badge |
A detailed look at how these thresholds work in practice lives in the IC passing score article. Note that no official candidate pass rate was verified, so be skeptical of any site quoting one; the IC pass rate page explains what can and cannot be said.
The Four Domains at a Glance
The blueprint defines four official domains. No percentage weights are published, so you cannot rationally skip one to concentrate on another. Use the exact headings below, including the comma after "Accounts" in Domain 2.
| # | Domain |
|---|---|
| 1 | Understanding the Cybersecurity Ecosystem |
| 2 | Securing Data, Accounts, and Digital Devices |
| 3 | Adopting Secure Digital Practices |
| 4 | Protecting Against Cyber Threats and Digital Risks |
For a full walkthrough of each content area, read the IC exam domains guide. The sections below give you the quick-review version, organized by what a candidate should be able to explain or do.
Domain 1: Understanding the Cybersecurity Ecosystem
Domain 1: Understanding the Cybersecurity Ecosystem
This domain is about the big picture: who and what is involved in keeping digital life safe, and why it matters to an ordinary user rather than only to IT specialists.
- Why security is a shared responsibility between individuals, organizations, and service providers
- The kinds of assets at stake: personal data, credentials, devices, and organizational information
- Common vocabulary candidates are expected to recognize in plain language
- The link between everyday user behavior and organization-wide risk
Treat this domain as the vocabulary and mindset layer. Questions here tend to reward clear conceptual understanding: if you can explain, in your own words, why a single careless click can affect a whole organization, you are in good shape. Because the weights are unpublished, do not under-study it just because it feels "easy"; it feeds the reasoning you need in the later domains.
Domain 2: Securing Data, Accounts, and Digital Devices
Domain 2: Securing Data, Accounts, and Digital Devices
This is the most hands-on domain, and the one most likely to surface in-application questions where you act inside a settings screen.
- Strong, unique credentials and sensible password management
- Extra verification layers on accounts, and when to turn them on
- Keeping devices updated and protected, including screen locks and software updates
- Protecting stored and transmitted data, and handling backups responsibly
- Recognizing where privacy and security settings live in common applications
Key Takeaway
Do not just read about account and device security. Open the security settings on your own accounts and devices, find each control, and practice explaining what it does. The in-application format rewards candidates who can locate the right setting quickly.
Domain 3: Adopting Secure Digital Practices
Domain 3: Adopting Secure Digital Practices
Where Domain 2 focuses on tools and settings, Domain 3 focuses on habits and judgment in everyday digital work and communication.
- Safe handling of email, messaging, and file sharing
- Careful behavior on public networks and shared or unfamiliar devices
- Sensible sharing of personal and organizational information online
- Applying good practice consistently, not just when you remember
Scenario questions are common in this area: a short situation, followed by choices that differ in how cautious or careless they are. The strongest answer usually balances security with getting the task done, so beware of choices that are technically "safe" but unrealistic, as well as choices that are convenient but expose data.
Domain 4: Protecting Against Cyber Threats and Digital Risks
Domain 4: Protecting Against Cyber Threats and Digital Risks
This domain moves from prevention habits to recognizing and responding to specific threats and risky situations.
- Spotting suspicious messages, links, attachments, and requests
- Understanding how malicious software and social-engineering attempts reach users
- Knowing what to do, and whom to tell, when something looks wrong
- Weighing digital risks to privacy, identity, and reputation
Interactive questions may ask you to flag the suspicious elements in a message or screen. Practice looking at a sample email and naming every warning sign you can find: mismatched sender details, urgency, unexpected attachments, odd links. If you want to see how these skills translate into work, the IC jobs overview describes where this kind of baseline awareness is valued.
Registration and Price Table
Testing runs on the Tosa/Isograd platform, either through approved Tosa centers or by remote proctoring that includes Integrity Advocate. In the U.S., English-language CyberCitizen is available at Prometric centers. The U.S. online store lists these packages:
| Package | U.S. Price | Includes |
|---|---|---|
| Certification Ready | USD 109 | One exam and proctoring |
| Certification Prep | USD 125 | Adds one practice assessment |
| Certification Prep Plus | USD 135 | Includes two practice assessments |
| Skill Builder (English) | USD 225 | Course, one practice assessment, exam, and proctoring |
| Skill Builder Plus (English) | USD 235 | Course, two practice assessments, exam, and proctoring |
Test-Day Rules and Proctoring
- Closed book, proctored throughout. No outside materials are allowed.
- No breaks. Plan for the full sitting, and handle everything you need before you begin.
- Photo ID. Valid photo identification is required.
- Remote delivery requirements: a computer, webcam, microphone, and internet connection.
- Entry barriers: No formal education, experience, training, or age prerequisite is specified; the IC requirements article covers eligibility in more depth.
If you test remotely, check your camera, microphone, and connection well ahead of time, and prepare a quiet, clear workspace. If you prefer an on-site experience, an approved center removes most technical risk. For scheduling logistics and timing considerations, consult the IC exam dates page.
Validity and Retake Terms: Where Sources Conflict
This is the one area where you must verify before relying on anything. Two sets of Tosa statements point in different directions:
| Source | What It Says |
|---|---|
| CyberCitizen blueprint and U.S. credential page | Three-year validity, with retesting for renewal or score improvement; a minimum 24-hour interval between retakes |
| Generic Tosa FAQ | Describes lifetime certification with scores becoming outdated after three years, no minimum retake waiting period, and a 551 minimum for other certifications |
Key Takeaway
Do not assume either version applies to you. Check the validity and retake terms shown in the specific booking channel you use, and screenshot them at purchase. The CyberCitizen-specific materials point to three-year validity and a 24-hour retake interval, but your channel's terms are what you will actually be held to.
A Domain-Ordered Prep Schedule
Preparation time is separate from exam time. The credential page recommends around 150 hours of training and practice for a Productive result or higher, while the public CyberCitizen Learning Lab course estimates 25-40 hours. These are recommendations, not admission requirements, and the course curriculum does not replace the four formal exam domains or guarantee exhaustive coverage. Because the domains are unweighted, an even spread works well, with the hands-on domain given extra practice time. If you want the broader plan, the IC study guide goes further.
Domain 1: Build the vocabulary
- Review the ecosystem and shared-responsibility concepts
- Write plain-language definitions for every term you meet
Domain 2: Get hands-on with settings
- Walk through account, device, and privacy settings on your own equipment
- Practice locating each control without hints, since in-application items test this
Domain 3: Work through scenarios
- Practice judgment questions about email, sharing, and public networks
- Explain why the best answer beats the second-best one
Domain 4: Threat recognition and full review
- Dissect sample suspicious messages and list every warning sign
- Take timed practice sets using the IC practice test to rehearse the 60-minute pace
Stretch or compress this plan depending on how much of the material is already familiar. Before you commit time and money, you may also want to weigh the broader payoff in the IC certification ROI analysis.
Frequently Asked Questions
The certification exam has 35 adaptive questions and a 60-minute limit. Questions are a mix of multiple-choice, interactive, and in-application formats, and the exam is available in English and French. A separate assessment described in the brochure is shorter, at 25 questions and 40 minutes, so do not confuse the two.
A score of 351 on the 1-1000 scale earns the certification diploma, while 1-350 earns a certificate of completion. To also qualify for a Credly digital badge, you need 551 or higher. These are proficiency bands, not percentages of questions answered correctly.
No percentage weights are published for the four domains: Understanding the Cybersecurity Ecosystem; Securing Data, Accounts, and Digital Devices; Adopting Secure Digital Practices; and Protecting Against Cyber Threats and Digital Risks. Since you cannot tell which counts more, study all four rather than gambling on one.
No formal education, experience, training, or age prerequisite is specified. You do need valid photo identification, and for remote testing you need a computer, webcam, microphone, and internet connection. Recommended preparation hours are guidance only, not an entry requirement.
The CyberCitizen blueprint and the U.S. credential page specify three-year validity, retesting for renewal or score improvement, and a minimum 24-hour interval between retakes. However, the generic Tosa FAQ describes different terms, so confirm the validity and retake rules in the booking channel you actually use before you pay.
No official candidate pass rate was verified, and this sheet does not quote one. For context on what the data can and cannot support, see the IC pass rate and IC salary guide articles, which treat both topics qualitatively rather than inventing numbers.