What Does IC Mean?

The Short Answer: What IC Means on This Site

On this site, IC stands for Isograd CyberCitizen, a certification that measures practical cybersecurity awareness for everyday digital users. It is not a credential for security engineers, penetration testers, or incident responders. It targets the much larger group of people who use email, cloud accounts, mobile devices, and workplace software and who, through everyday choices, either strengthen or weaken an organization's defenses.

The acronym "IC" is used elsewhere in the credentialing world for entirely different programs, run by different bodies with different exams. Nothing in this article applies to those. Everything below describes Isograd CyberCitizen only. If you want the shortest possible definitions of the term, our related explainers cover the same ground from different angles: What Is IC?, IC Meaning, and What Does IC Stand For?

Why the Name Is Confusing: Isograd, Tosa, and CyberCitizen

Candidates often get stuck on naming before they even reach the exam content. The governing and administering body is Isograd/Tosa. Isograd is the organization behind the assessment methodology, and Tosa is the brand under which its digital-skills certifications are sold to individuals. The current public name of this credential is Tosa CyberCitizen, and its public certification page sits on the Tosa website rather than under an "Isograd" banner.

"IC" is simply the identifier this site uses for the program. So when you see Isograd CyberCitizen, Tosa CyberCitizen, or IC used in this context, they all point to the same cybersecurity-awareness certification. When you search for it, expect to see both brand names in results, and make sure you are reading material about this specific exam and not about one of the other certifications that happen to share the abbreviation.

For a variant of this question phrased in the way many people type it into search engines, see What Is A IC? and What Is IC Certification?

What the Credential Actually Measures

The exam does not test whether you can configure a firewall or analyze malware. It tests whether you understand the security landscape well enough to behave safely in it. Questions are drawn from realistic digital situations: handling a suspicious message, protecting a login, deciding what to do with a lost device, or recognizing a risky request. The emphasis is on judgment and applied knowledge, which is why the format includes more than plain multiple choice.

Three item types appear on the certification exam:

• Multiple-choice questions that test recognition of correct practices and definitions.
• Interactive questions in which you manipulate or arrange elements to show you understand a process or relationship.
• In-application questions that place you in a simulated software context and ask you to perform an action, such as changing a setting.

That mix matters for preparation. Memorizing terminology will carry you only part of the way, because in-application and interactive items reward people who have actually used the settings and tools involved. Candidates who have only read about two-factor authentication, for example, may hesitate when asked to find the relevant control in a simulated interface.

The Four Exam Domains in Plain Language

The official Tosa CyberCitizen exam blueprint is a 24-page document organized into four domains. The blueprint does not publish percentage weights, so you should not assume any domain is worth more than another. Treat all four as fair game. For a deeper walkthrough of how the domains are structured, read our complete guide to all four IC content areas.

How the Exam Works: Format, Timing, and Scoring

The certification exam consists of 35 adaptive questions with a 60-minute limit. Adaptive means the difficulty responds to your answers, so two candidates will not necessarily see the same sequence of items. The exam is available in English and French.

Scoring uses item response theory to place you on a 1-1000 proficiency scale. This is the single most important concept for interpreting results, and it trips up many first-time candidates. Your score is not a percentage of questions answered correctly. Because items vary in difficulty and the test adapts, the scale estimates your underlying proficiency rather than counting right answers. That is why searching for a conventional "percent to pass" figure is a dead end. Our passing score guide explains the thresholds in detail.

The current brochure distinguishes the shorter 25-question, 40-minute assessment from the full certification exam. The brochure does not state that this separate assessment is specifically a recruitment test, so avoid assuming it is one. If you are preparing for the credential itself, the 35-question, 60-minute exam is the one that matters.

What the Score Bands Mean

Results fall into five proficiency bands, and what you receive depends on which band you land in:

The practical threshold to remember is 351: that is where the certification diploma begins. The second threshold is 551, which unlocks the shareable Credly badge that many candidates want for professional profiles. These are scaled proficiency bands rather than percentages correct, so a score of 551 does not mean you answered 55 percent of questions correctly.

Who Takes It and What Employers Can Read From It

Because the credential is aimed at general digital users, the audience is broad: employees onboarding at organizations that want a baseline security posture, students building a verifiable digital-skills profile, and job seekers who want to show that they take security seriously. There is no formal education, experience, training, or age prerequisite specified, which keeps the barrier to entry low. You do need valid photo identification on exam day. Our requirements guide covers eligibility in more depth.

What employers can reasonably infer from the result is awareness and applied judgment in everyday security situations, not specialist technical capability. That distinction shapes how you should present it. Think of it as evidence that you will not be the easiest target in the building, rather than a qualification to run a security team. If you are weighing career value, see our analyses of whether the certification is worth it, the roles where it can help, and the salary picture. Be skeptical of any source that promises specific earnings uplift from an awareness-level credential.

Booking and Pricing Mechanics

Testing runs on the Tosa/Isograd platform and is delivered either through approved Tosa centers or by remote proctoring, including the Integrity Advocate service. In the United States, the English-language exam is also supported at Prometric centers. The exam is closed book and proctored throughout, with no breaks and no outside materials. For remote delivery you need a computer, webcam, microphone, and internet connection.

The U.S. online store lists several packages, and the inclusions follow whichever product you select:

The price gap between the cheapest and richest bundles is modest, so the real decision is how much structured preparation you want. For the full fee picture, including what changes by region or channel, read our certification cost breakdown, and check the exam dates and scheduling guide for booking logistics.

Validity and Retakes: Where the Sources Disagree

This is the area where candidates most often get contradictory information, so it deserves careful reading. The CyberCitizen blueprint and the directly retrieved U.S. credential page specify three-year validity and describe retesting for renewal or score improvement, with a minimum 24-hour interval between retakes.

However, the general Tosa FAQ describes a different framework: lifetime certification in which scores simply become outdated after three years, no minimum retake waiting period, and a 551 minimum for other certifications, including digital literacy. That is a generic policy statement and does not override CyberCitizen's own materials, which retain the specific 351 diploma and 551 badge distinction.

Matching Your Preparation to the Domains

Two official numbers help you plan, and they are often confused. The credential page recommends around 150 hours of training and practice for candidates aiming at Productive or higher. The public CyberCitizen Learning Lab course, by contrast, estimates 25-40 hours. Both are preparation recommendations, not admission requirements, and neither is exam time. Importantly, the course curriculum does not replace the four formal exam domains and is not established as exhaustive exam coverage, so use the blueprint as your master checklist.

If you are aiming for the badge threshold, here is one way to sequence the domains, ordered by dependency rather than difficulty:

For a fuller methodology, our IC study guide expands this approach, and the cheat sheet gives you a compact pre-exam review. If you are unsure how demanding the exam will feel, see how hard the exam really is. On pass rates, note that no official candidate pass rate was verified, so be wary of any figure presented as fact; our pass rate analysis explains what can and cannot be said. When you are ready to test yourself against realistic questions, try the IC practice tests and compare your results to the scaled score bands above.

Frequently Asked Questions