IC Study Guide 2026: How to Pass on Your First Attempt

What You're Actually Studying For

Isograd CyberCitizen (IC) is a cybersecurity awareness certification aimed at ordinary digital users rather than security engineers. It is administered by Isograd/Tosa, and the current public brand on the Tosa site is Tosa CyberCitizen, so if you search for registration pages you will see that name. The exam measures whether you can recognize risks, protect accounts and devices, and behave safely in everyday digital work. It is not a penetration-testing or network-engineering credential, and studying as though it were is one of the most common ways to waste preparation time.

If you are still orienting yourself, the background pieces on what IC certification is and what IC stands for cover the basics. This guide assumes you have decided to sit the exam and want a plan that gets you through it on the first attempt.

The Exam Format and Scoring Bands

The certification exam consists of 35 adaptive questions with a 60-minute limit. Questions come in three styles: standard multiple-choice, interactive items, and in-application questions where you perform or judge an action inside a simulated environment. English and French are both available. Because the test is adaptive, the difficulty of what you see responds to how you have answered so far, and scoring uses item response theory rather than a simple count of correct answers.

That last point matters for how you read your result. The score is a scaled proficiency figure from 1 to 1000, and the bands are not percentages correct:

For a detailed look at how these thresholds work in practice, see the breakdown of the IC passing score. The practical takeaway for planning is that "passing" has two meaningful lines: 351 for the certification diploma, and 551 if you want a shareable digital badge. Decide before you start which one you are aiming for, because it changes how much preparation is reasonable.

No official candidate pass rate has been verified, so be wary of any site quoting a precise figure. The article on the IC pass rate discusses what can and cannot be said responsibly.

The Four Domains and What to Master in Each

The current blueprint lists four domains and publishes no percentage weights. Without weights, the sensible default is balanced coverage, with extra time on whichever domain your self-assessment shows is weakest. The full breakdown lives in the IC exam domains guide; here is the study-oriented summary.

How Many Hours to Plan

Two official figures exist, and they measure different things. The credential page recommends around 150 hours of training and practice for candidates aiming at Productive or higher. The public CyberCitizen Learning Lab course estimates 25-40 hours. These are preparation recommendations, not admission requirements, and they should not be confused with the 60 minutes of exam time.

How do you reconcile them? A reasonable reading is that the course gets you through the core material, while the larger figure reflects the practice and reinforcement needed to land in the higher bands. If your goal is simply the 351 diploma and you already use security tools daily, the lower figure may be a realistic starting point. If you want the badge or higher, plan closer to the larger recommendation and measure progress with practice assessments rather than assuming hours alone will carry you.

Many candidates ask whether the effort is worth it before committing. The analyses in how hard the IC exam is and whether the IC certification is worth it can help you calibrate.

A Domain-Ordered Study Schedule

Generic scheduling advice is easy to find; what helps here is ordering the work by how the domains build on each other. Domain 1 supplies vocabulary, Domains 2 and 3 are practical, and Domain 4 applies everything to scenarios. A four-week plan that follows that logic looks like this, assuming you are working toward the badge threshold and adjusting the pace to your own availability:

If you have less time, compress rather than skip: keep the order, shorten each block, and keep the final timed simulation. A one-page recap such as the IC cheat sheet is useful for the last day, but it works best as a review of material you have already practiced rather than a first exposure.

Handling an Adaptive, Mixed-Format Test

What adaptivity changes

With 35 questions and 60 minutes, you have under two minutes per item on average, but the questions will not all feel equally difficult. As you answer well, you may see harder items; that is the test working as designed, not a sign you are failing. Avoid trying to reverse-engineer your performance mid-exam, since the scoring model weighs items in ways you cannot see.

Preparing for three question types

Multiple-choice items reward careful reading of what is actually being asked. Interactive items typically require you to arrange, select, or classify elements, so practice with hands-on exercises rather than only reading. In-application questions place you in a simulated interface and ask you to do the right thing, which is why actually configuring settings during study beats memorizing them from a list.

Booking, Packages and Exam-Day Rules

There are no formal education, experience, training, or age prerequisites specified for IC, but valid photo identification is required at testing. The IC requirements article covers eligibility in more detail. Delivery runs on the Tosa/Isograd platform through approved Tosa centers or remote proctoring, including Integrity Advocate. In the U.S., English-language CyberCitizen is also available at Prometric centers.

For remote delivery you need a computer, webcam, microphone, and a working internet connection. Test the setup and your room in advance rather than on exam day.

On the U.S. store, the exam is sold in bundles. Package inclusions follow the product you select:

For a full look at pricing considerations, see the IC certification cost breakdown, and confirm current prices on the official store before purchasing. For scheduling mechanics, the IC exam dates guide explains how booking and availability work.

One distinction to keep straight: the current brochure describes a separate assessment of 25 questions and 40 minutes, distinct from the certification exam of 35 questions and 60 minutes. Make sure the product you book is the certification exam if a formal credential is what you want.

Validity, Retakes and the Policy Conflict

Official sources do not fully agree on validity and retake rules, so read the terms for your booking channel carefully. The CyberCitizen blueprint and the directly retrieved U.S. credential page specify three-year validity and retesting for renewal or score improvement, with a minimum 24-hour interval between retakes. The generic Tosa FAQ, by contrast, describes lifetime certification with scores becoming outdated after three years, no minimum retake waiting period, and a 551 minimum for other certifications including digital literacy.

Practically, this means you should not plan a first attempt as a throwaway "trial run" without checking whether retakes carry an additional fee in your booking channel. Prepare as though you intend to pass once.

After the Exam: Using Your Result

Your band determines what you receive: a certificate of completion below 351, the certification diploma from 351, and a Credly digital badge from 551 upward. A badge is easy to add to a professional profile, which is where the credential tends to earn its keep. Because IC is an awareness-level certification, it is most often relevant to roles where staff handle sensitive data or interact with customers and colleagues digitally, rather than dedicated security positions. If career outcomes are your main motivation, read the IC jobs overview and the IC salary guide with realistic expectations about what an awareness credential can and cannot do on its own.

If you want structured repetition before test day, the IC practice tests let you rehearse the question styles under timed conditions, and the IC training page outlines other preparation routes. You can also return to the main practice test site to track which domains need another pass.

Frequently Asked Questions