- How the Isograd CyberCitizen Blueprint Is Organized
- Exam Format That Shapes How Domains Are Tested
- Domain 1: Understanding the Cybersecurity Ecosystem
- Domain 2: Securing Data, Accounts, and Digital Devices
- Domain 3: Adopting Secure Digital Practices
- Domain 4: Protecting Against Cyber Threats and Digital Risks
- Why No Domain Weights Changes Your Planning
- Scoring Bands and What They Mean for Domain Mastery
- Sequencing the Four Domains Across Your Prep
- Booking, Fees, and Policy Details That Affect Your Plan
- Who Benefits From This Credential
- Frequently Asked Questions
- The current Tosa CyberCitizen blueprint defines four official domains, and no percentage weights are published for any of them.
- The certification exam is 35 adaptive questions in 60 minutes, mixing multiple-choice, interactive, and in-application items.
- Scores sit on a 1-1000 scale; 351 earns the diploma and 551 or higher also earns a Credly badge.
- Domain 2 is the most hands-on area: accounts, data, and devices are where in-application questions are most natural.
How the Isograd CyberCitizen Blueprint Is Organized
Isograd CyberCitizen is a certification from Isograd/Tosa that measures everyday cybersecurity competence for people who are not security engineers. The current public brand is Tosa CyberCitizen, and this site uses "IC" as its identifier for the credential. If you are new to the terminology, our explainers on what IC certification is and what IC stands for cover the naming in more detail.
The official blueprint is a 24-page PDF published by Tosa. It organizes the exam into exactly four content areas, and the exact headings matter because they are how you should label your own notes:
- Understanding the Cybersecurity Ecosystem
- Securing Data, Accounts, and Digital Devices
- Adopting Secure Digital Practices
- Protecting Against Cyber Threats and Digital Risks
Notice the comma after "Accounts" in Domain 2. It is a small detail, but it reflects the current blueprint wording, and it is a useful reminder to anchor your preparation to the current linked document rather than older indexed frameworks that may circulate online. The blueprint PDF carries no visible publication date, so treat the official Tosa link as the controlling source and re-check it before you book.
Exam Format That Shapes How Domains Are Tested
Before diving into each domain, it helps to understand the delivery format, because the format determines how knowledge is checked. The certification exam has 35 adaptive questions with a 60-minute limit. Questions come in three styles: multiple-choice, interactive, and in-application. The exam is available in English and French.
Because the exam is adaptive, the difficulty of what you see responds to how you answer. Scoring uses item response theory on a 1-1000 proficiency scale, so your result reflects estimated proficiency rather than a simple count of correct answers. That is why the bands are not percentages. For a deeper look at how hard candidates find this format, see How Hard Is the IC Exam?
| Item | Certification exam | Separate assessment (per brochure) |
|---|---|---|
| Questions | 35 adaptive | 25 |
| Time limit | 60 minutes | 40 minutes |
| Purpose | Certification result and credential | Distinct from the certification exam |
The current brochure draws this distinction clearly. Do not confuse the two when reading prep material, since a practice assessment's length and timing will differ from the real certification exam.
Domain 1: Understanding the Cybersecurity Ecosystem
The first domain is about orientation. Before a candidate can behave securely, they need a mental map of who and what is involved in cybersecurity: the kinds of actors, the kinds of assets worth protecting, and how risks arise in a connected environment.
Domain 1: Understanding the Cybersecurity Ecosystem
This area builds the vocabulary and conceptual framework that the other three domains rely on. Expect questions that test whether you can recognize terms and situations rather than operate software.
- Core cybersecurity vocabulary and why digital assets need protection
- The roles of individuals, organizations, and attackers in the threat landscape
- How everyday digital activity creates exposure to risk
- The idea that security is a shared responsibility, not just an IT function
Candidates often underestimate this domain because it feels like common knowledge. In practice, adaptive questioning can probe whether you can distinguish closely related concepts, so precise definitions pay off. Build a short personal glossary as you study, and revisit it before test day. If you want a compact reference, our IC cheat sheet is a good companion for last-minute review.
Domain 2: Securing Data, Accounts, and Digital Devices
Domain 2 is the practical heart of the credential. It addresses the three things ordinary users actually control: the information they hold, the accounts that give access to it, and the devices they use every day.
Domain 2: Securing Data, Accounts, and Digital Devices
This is where interactive and in-application question styles are most natural, because the skills involve configuring and using real tools rather than reciting definitions.
- Protecting data: handling, storing, and sharing information responsibly
- Protecting accounts: credential hygiene and safer sign-in habits
- Protecting devices: keeping computers and mobile devices configured and maintained securely
- Recognizing when a setting, permission, or behavior weakens protection
Because in-application questions can place you inside a simulated environment, reading about settings is not enough. If you can, practice in real applications and on your own devices so that locating a security option feels familiar. Candidates who only memorize theory tend to hesitate when asked to act. The format rewards muscle memory as well as knowledge.
Key Takeaway
Spend hands-on time for Domain 2. Open the security and privacy settings of the tools you already use, and practice finding and changing them without hints, because in-application items test doing, not just knowing.
Domain 3: Adopting Secure Digital Practices
Where Domain 2 focuses on the things being protected, Domain 3 focuses on behavior. It asks whether a candidate consistently makes safe choices in daily digital routines, at work and in personal life.
Domain 3: Adopting Secure Digital Practices
This area tests judgment in realistic scenarios: what a careful person would do when faced with a common situation.
- Safe habits for communication, browsing, and online collaboration
- Responsible use of networks, shared resources, and workplace tools
- Choosing secure options by default rather than as an afterthought
- Applying good practice consistently, not only when prompted
Scenario-style questions in this domain often present several plausible actions and ask you to pick the safest or most appropriate one. The wrong answers are usually reasonable-sounding but slightly riskier. Train yourself to ask, for each option, "what could go wrong if I did this?" The best answer is typically the one that reduces exposure without sacrificing the task at hand.
Domain 4: Protecting Against Cyber Threats and Digital Risks
The final domain turns to active threats and the risks that come with them. It is about recognizing danger when it appears and knowing how to respond or reduce harm.
Domain 4: Protecting Against Cyber Threats and Digital Risks
Expect to identify warning signs, understand how common attacks work at a conceptual level, and choose sensible protective or responsive actions.
- Recognizing common categories of cyber threats and how they reach users
- Spotting suspicious messages, requests, and behavior
- Understanding digital risks beyond malicious attacks, such as exposure through carelessness
- Knowing appropriate protective steps and when to escalate or report a problem
This domain pairs naturally with the others. A threat in Domain 4 usually exploits a weakness covered in Domain 2 or a bad habit covered in Domain 3, so studying them together reinforces both. Link each threat you learn about to the specific protection that counters it.
Why No Domain Weights Changes Your Planning
Many certifications publish a percentage for each domain so candidates can allocate study time proportionally. The CyberCitizen blueprint does not. No weights are published, and with an adaptive format there is no fixed number of questions per domain that you can count on.
The practical consequence is straightforward: avoid guessing at a hidden distribution. Treat the four domains as roughly equal priorities, then adjust based on your own results from practice. Any source that claims precise per-domain percentages for this exam is not drawing on the official blueprint. Likewise, there is no verified official pass rate, so be cautious about any figure you see; our piece on the IC pass rate explains what can and cannot be said.
Scoring Bands and What They Mean for Domain Mastery
Your final result is placed on a 1-1000 scale and mapped to a proficiency band. These are scaled proficiency bands, not percentages of questions answered correctly.
| Band | Score range | Outcome |
|---|---|---|
| Beginner | 1-350 | Certificate of completion |
| Basic | 351-550 | Certification diploma |
| Productive | 551-725 | Diploma and Credly digital badge |
| Advanced | 726-875 | Diploma and Credly digital badge |
| Expert | 876-1000 | Diploma and Credly digital badge |
The distinction that matters most is between 351 and 551. Reaching 351 earns the certification diploma, while 551 or higher adds a shareable Credly badge. If you want a visible, verifiable credential for a profile or CV, aim for Productive or above. For a closer look at the thresholds, read our guide to the IC passing score.
The credential page recommends around 150 hours of training and practice for Productive or higher. That figure is a preparation recommendation, not an admission requirement. By contrast, the public CyberCitizen Learning Lab course estimates 25-40 hours. These two numbers describe different things, and neither replaces working through all four formal domains.
Sequencing the Four Domains Across Your Prep
One short note on methodology, tied directly to the domains: the order in which you study them matters because they build on each other. Start with vocabulary, move to hands-on skills, then behavior, then threats that exploit gaps in the earlier areas. For a broader plan, see the IC study guide.
Domain 1 foundations
- Build your glossary of core terms
- Map the actors and assets in the cybersecurity ecosystem
Domain 2 hands-on
- Work through settings for data, accounts, and devices in real tools
- Practice finding options without prompts
Domains 3 and 4 together
- Drill scenario questions on safe practices
- Pair each threat with the protection that counters it
Timed review
- Take full-length timed practice under 60-minute conditions
- Revisit the weakest domain based on results
You can compress or extend this depending on your starting point and your target band. Someone aiming for Productive or higher should allow more time than someone targeting the diploma. When you are ready to test yourself, use our practice test platform to rehearse the format.
Booking, Fees, and Policy Details That Affect Your Plan
Knowing the logistics keeps surprises out of exam day. Testing is delivered on the Tosa/Isograd platform through approved Tosa centers or by remote proctoring, including Integrity Advocate. In the United States, English-language CyberCitizen is available at Prometric centers. There is no formal education, experience, training, or age prerequisite, but valid photo identification is required. See IC requirements for the full eligibility picture.
| U.S. store option | Price | What is included |
|---|---|---|
| Certification Ready | USD 109 | One exam and proctoring |
| Certification Prep | USD 125 | Adds one practice assessment |
| Certification Prep Plus | USD 135 | Includes two practice assessments |
| Skill Builder (English) | USD 225 | Course, one practice assessment, exam, and proctoring |
| Skill Builder Plus (English) | USD 235 | Course, two practice assessments, exam, and proctoring |
Package inclusions follow the product you select, so confirm what is bundled before purchasing. For a fuller breakdown, see the IC certification cost guide, and check IC exam dates for scheduling considerations.
On exam day, the test is closed book and proctored throughout, with no breaks and no outside materials. Remote delivery requires a computer, webcam, microphone, and internet connection. Run any system check offered in advance so a technical issue does not eat into your 60 minutes.
Who Benefits From This Credential
Because the four domains target everyday security competence rather than specialist engineering, the credential suits a wide audience: employees in any department, students entering the workforce, and professionals who handle sensitive information as part of their jobs. Employers can use it as evidence that staff understand basic safe behavior online. It is not a replacement for advanced technical security certifications, and it should be viewed as a foundation.
If you are weighing the investment, our analyses of whether the IC certification is worth it and the IC jobs landscape can help you decide how it fits your goals. Treat any earnings discussion cautiously, since no verified salary figure is tied to this credential.
Key Takeaway
The four domains move from understanding, to protecting assets, to behaving safely, to defending against threats. Study them as a connected chain, because adaptive questioning can reach into any link at any time.
Frequently Asked Questions
The current Tosa CyberCitizen blueprint lists four domains: Understanding the Cybersecurity Ecosystem; Securing Data, Accounts, and Digital Devices; Adopting Secure Digital Practices; and Protecting Against Cyber Threats and Digital Risks.
No percentage weights are published for the four domains. Because the exam is adaptive, you should prepare evenly across all four rather than assume a fixed split.
The certification exam has 35 adaptive questions in 60 minutes, combining multiple-choice, interactive, and in-application questions. It is offered in English and French.
A score of 351 or higher on the 1-1000 scale earns the certification diploma. A score of 551 or higher also qualifies you for a Credly digital badge. These are scaled proficiency bands, not percentages correct.
No. The course, estimated at 25-40 hours, is a preparation aid and does not replace the four formal exam domains or guarantee exhaustive coverage. Use the blueprint as your primary reference.