- The Short Answer: IC Is Isograd CyberCitizen
- Why the Name Shows Up as Tosa CyberCitizen
- What the Credential Actually Measures
- The Four Exam Domains
- Exam Format and Question Styles
- Scoring Bands and What You Earn
- Cost and Booking Mechanics
- Who Takes It and Who Notices It
- Avoiding Acronym Confusion
- Matching Prep Time to the Domains
- Frequently Asked Questions
- On this site, IC means Isograd CyberCitizen, a cybersecurity awareness certification for everyday digital users.
- The current public brand is Tosa CyberCitizen, administered by Isograd/Tosa.
- The exam has 35 adaptive questions, a 60-minute limit, and four official domains with no published weights.
- Scores run 1-1000; 351 earns the diploma and 551 or higher also unlocks a Credly badge.
The Short Answer: IC Is Isograd CyberCitizen
If you landed here asking what IC stands for, here is the direct answer for this site: IC stands for Isograd CyberCitizen. It is a certification that measures how well a person understands and applies everyday cybersecurity practices: protecting accounts, handling data carefully, recognizing threats, and behaving safely online. It is aimed at ordinary workers, students, and job seekers rather than security engineers.
The acronym "IC" is not unique in the credential world, and that is exactly why this page exists. Everything described here refers only to Isograd CyberCitizen. If you want a broader introduction after reading this, our guides on what IC is and what IC certification involves go deeper, and the IC practice test hub lets you try questions in the real style of the exam.
Why the Name Shows Up as Tosa CyberCitizen
The certification is governed and administered by Isograd/Tosa. Isograd is the organization behind the Tosa family of digital skills assessments, and the current public-facing brand for this credential is Tosa CyberCitizen. "IC" is simply the identifier used on this site to refer to the Isograd CyberCitizen credential.
In practice, this means you will see slightly different names depending on where you look:
| Where you see it | Name you are likely to encounter |
|---|---|
| Official certification page and blueprint | Tosa CyberCitizen |
| Exam store and booking pages | CyberCitizen (listed under the Tosa program) |
| This site | IC, short for Isograd CyberCitizen |
All of these point to the same exam. When you register, look for CyberCitizen under Tosa; you will not find a product literally labelled "IC."
What the Credential Actually Measures
CyberCitizen is a practical awareness and behavior certification. It does not ask you to configure firewalls or write detection rules. Instead, it checks whether you can recognize risky situations, choose safe options, and use common tools securely. The exam mixes multiple-choice items with interactive and in-application questions, so some tasks resemble real actions you would take in software rather than pure recall.
That orientation shapes who the credential suits. Employers who want every staff member to meet a baseline of cyber hygiene, schools building digital literacy, and individuals who want a verifiable signal of safe digital habits are the natural audience. For a closer look at roles where this shows up, see our overview of IC jobs, and for the career-value question, read whether the IC certification is worth it.
The Four Exam Domains
The current Tosa CyberCitizen exam blueprint organizes the content into four domains. No percentage weights are published, so you should not assume any domain carries more questions than another. Treat all four as fair game. The exact headings below follow the blueprint, including the comma after "Accounts" in Domain 2.
Domain 1: Understanding the Cybersecurity Ecosystem
This domain builds the vocabulary and mental map for everything else. Candidates should be comfortable with who and what is involved in keeping digital life safe.
- How threats, attackers, defenders, and everyday users relate to one another
- Why individual behavior matters inside an organization's security posture
- The basic concepts and terminology you will meet in the other three domains
Domain 2: Securing Data, Accounts, and Digital Devices
This is the hands-on hygiene domain. It covers the protective habits that apply to the information you hold and the equipment you use daily.
- Protecting personal and professional data
- Managing accounts and credentials responsibly
- Keeping computers, phones, and other devices secure
Domain 3: Adopting Secure Digital Practices
Where Domain 2 is about what you protect, this domain is about how you behave. It emphasizes routines and judgment during normal online activity.
- Safe habits for browsing, communicating, and sharing information
- Applying security-minded choices in everyday work tasks
- Recognizing when a routine action carries risk
Domain 4: Protecting Against Cyber Threats and Digital Risks
This domain focuses on spotting and responding to threats once you are in the moment.
- Recognizing common attack patterns and suspicious situations
- Responding sensibly when something looks wrong
- Understanding broader digital risks beyond a single attack
For a full walk-through of how each area is tested, see our complete guide to the four IC exam domains.
Exam Format and Question Styles
The certification exam is short and adaptive, which makes it feel different from long fixed-form tests.
| Feature | Detail |
|---|---|
| Number of questions | 35, adaptive |
| Time limit | 60 minutes |
| Question types | Multiple-choice, interactive, and in-application |
| Languages | English and French |
| Conditions | Closed book, proctored throughout, no breaks or outside materials |
| Remote requirements | Computer, webcam, microphone, and internet connection |
Adaptive means the difficulty of upcoming questions responds to how you answer earlier ones. Because the exam is scored using item response theory, your result reflects the difficulty of the items you handled correctly, not a simple count of right answers. That is why published scores are proficiency levels rather than percentages.
If you are wondering how demanding all of this is in practice, our breakdown of how hard the IC exam is addresses that directly.
Scoring Bands and What You Earn
Results are reported on a 1-1000 proficiency scale. Each band maps to a level and a specific credential outcome:
| Level | Score range | What you receive |
|---|---|---|
| Beginner | 1-350 | Certificate of completion |
| Basic | 351-550 | Certification diploma |
| Productive | 551-725 | Diploma plus Credly digital badge |
| Advanced | 726-875 | Diploma plus Credly digital badge |
| Expert | 876-1000 | Diploma plus Credly digital badge |
Two points deserve emphasis. First, these are scaled proficiency bands, not percentages correct, so a score of 551 does not mean 55 percent of answers were right. Second, the line that matters most for many candidates is 351 for the diploma and 551 for the badge. Our dedicated page on the IC passing score explains how to read these thresholds, and the IC pass rate article covers what is and is not known publicly; note that no official candidate pass rate has been verified.
Cost and Booking Mechanics
There is no formal education, experience, training, or age prerequisite for the exam. What you do need is valid photo identification. Testing runs on the Tosa/Isograd platform, either through approved Tosa centers or by remote proctoring, which includes Integrity Advocate. In the United States, English-language CyberCitizen is also available through Prometric centers.
The U.S. online store lists several bundles. Package inclusions follow the product you select:
| Package | Price (USD) | What is included |
|---|---|---|
| Certification Ready | 109 | One exam and proctoring |
| Certification Prep | 125 | Adds one practice assessment |
| Certification Prep Plus | 135 | Includes two practice assessments |
| Skill Builder (English) | 225 | Course, one practice assessment, exam, and proctoring |
| Skill Builder Plus (English) | 235 | Course, two practice assessments, exam, and proctoring |
For the full picture of what to budget, including retakes, see our IC certification cost breakdown, and for scheduling logistics, IC exam dates and booking windows.
Key Takeaway
Validity and retake terms are not perfectly uniform across Tosa materials. The exact CyberCitizen blueprint and the U.S. credential page specify three-year validity and a minimum 24-hour interval between retakes, while the general Tosa FAQ describes different generic terms. Always confirm the terms shown in the booking channel you actually use before you pay.
Who Takes It and Who Notices It
Because there are no prerequisites, the candidate pool is broad: office staff completing a workplace compliance goal, students adding a verifiable digital skill, career changers, and anyone wanting proof of safe-online competence. The credential's Credly badge for Productive-level scores and above makes it easy to share on professional profiles.
Be realistic about what the credential signals. It demonstrates awareness and practical judgment, not engineering expertise, so it works best as a baseline qualification or a complement to other skills. If earning potential is your concern, read our IC salary guide to see how to think about it without inflated promises, and check IC requirements if you want the eligibility details in one place.
Avoiding Acronym Confusion
The letters "IC" are shared by other, unrelated credentials and terms. A candidate who searches loosely can easily end up reading fees, exam lengths, or score scales that belong to a completely different certification. To stay safe:
- Confirm the certifying body is Isograd/Tosa.
- Confirm the exam is 35 adaptive questions in 60 minutes on a 1-1000 scale.
- Confirm the four domain names match those listed above.
- Treat any source that quotes different domains or a different score scale as describing another credential.
For quick definitions of related phrasing, our short explainers on IC meaning and what IC means cover the same ground from different angles.
Matching Prep Time to the Domains
Preparation time is separate from exam time and is a recommendation, not a requirement. The credential page suggests around 150 hours of training and practice for Productive-level results or higher, while the public CyberCitizen Learning Lab course estimates 25-40 hours. The course does not replace the four formal domains and should not be treated as exhaustive exam coverage, so use the blueprint as your anchor.
Because the exam is adaptive and unweighted, a sensible approach is to sequence the domains so each builds on the last:
Domain 1 foundations
- Learn the ecosystem vocabulary first so later domains make sense
- Skim the blueprint headings so you know the scope
Domains 2 and 3 habits
- Practice account, data, and device protection scenarios
- Rehearse everyday secure behaviors in interactive-style questions
Domain 4 and full timing
- Work through threat-recognition scenarios
- Take a timed run to get used to 35 questions in 60 minutes
For a fuller plan, see the IC study guide, the one-page IC cheat sheet, and the overview of IC training options. When you are ready to test yourself, head to the IC practice exams.
Frequently Asked Questions
On this site, IC stands for Isograd CyberCitizen, a cybersecurity awareness certification administered by Isograd/Tosa and currently branded publicly as Tosa CyberCitizen.
No. It measures everyday cyber awareness and safe digital behavior across four domains, aimed at general users rather than security engineers.
The certification exam has 35 adaptive questions with a 60-minute limit. It includes multiple-choice, interactive, and in-application questions and is available in English and French.
A score of 351 or higher on the 1-1000 scale earns the certification diploma, and 551 or higher also qualifies for a Credly digital badge. These are proficiency bands, not percentages correct.
No formal education, experience, training, or age prerequisite is specified. You do need valid photo identification, and you must test either at an approved center or through remote proctoring.