What Is A IC?

What Isograd CyberCitizen Actually Is

If you searched for "what is a IC" and landed here, you may have already hit a wall of unrelated results, because the letters IC are claimed by several unrelated credentials and technical terms. On this site, IC means one thing only: Isograd CyberCitizen, a certification that measures practical cybersecurity awareness for everyday digital users and workers.

The credential is not aimed at security engineers or penetration testers. It tests whether an ordinary employee, student, or job seeker understands how to protect data, accounts, and devices, how to recognize digital threats, and how to behave safely online. Think of it as a verified, scored statement that a person can be trusted with company systems and personal information without being the weakest link.

For a broader orientation on the credential, our companion pages What Is IC Certification? and IC Certification cover the basics from slightly different angles. This article focuses on what the exam is, how it is structured, and what a candidate should expect before booking.

Why You See Both "IC" and "Tosa CyberCitizen"

The governing and administering body is Isograd, which operates the Tosa certification brand. The current public name of the credential is Tosa CyberCitizen. "IC" is simply the identifier used on this site for Isograd CyberCitizen. If you browse the official Tosa credential page, you will see the Tosa branding; if you see references to Isograd, that is the organization behind the platform.

This matters practically: when you look for official information, search for Tosa CyberCitizen, not "IC." Searching the bare acronym will pull in unrelated certifications with different bodies, fees, and rules, and mixing those facts with CyberCitizen details is the fastest way to misunderstand what you are signing up for. Our short explainers What Does IC Stand For? and IC Meaning address the naming question in more depth.

How the Exam Is Built

The certification exam is compact and adaptive. Here are the core mechanics:

What "adaptive" means for you

Because the exam adapts, the questions you see respond to how you have answered earlier items. Two candidates will not necessarily receive the same set. That is why the result is reported as a proficiency score rather than a count of correct answers, and why trying to memorize a fixed question list is a poor strategy for this credential.

Interactive and in-application questions

Not every item is a classic four-option multiple-choice question. Some are interactive, and some take place inside a simulated application environment, where you demonstrate what you would actually do, such as adjusting a setting or handling a realistic scenario. Candidates who only read about security tend to underperform on these items; those who have actually configured accounts and devices find them far more natural.

Remote versus center testing

You can test at an approved Tosa center or remotely with proctoring, including Integrity Advocate. Remote delivery requires a computer, webcam, microphone, and internet connection. In the U.S. store, English-language CyberCitizen is supported at Prometric centers. Valid photo identification is required either way.

A separate shorter assessment exists

The current brochure also describes a separate assessment of 25 questions and 40 minutes, distinct from the 35-question, 60-minute certification exam. Do not confuse the two when reading reviews or planning your session. The brochure does not establish that the shorter assessment is specifically a recruitment test, so treat it simply as a different, shorter format.

The Four Exam Domains

The exam content follows four domains defined in the current Tosa CyberCitizen blueprint, a 24-page document. No percentage weights are published for these domains, so you should not assume any one area carries more weight than another. The exact domain headings are listed below, and our dedicated IC Exam Domains guide goes deeper into each one.

The domain descriptions above summarize the intent of each heading. The blueprint is the controlling source for exact scope, and note that the Learning Lab course curriculum does not replace the four formal exam domains or establish exhaustive exam coverage. Always anchor your study to the blueprint itself.

Scoring: Proficiency Bands, Not Percentages

This is the part candidates misread most often. Scores use item response theory on a 1-1000 scale. The result is a scaled proficiency level, not a percentage of questions answered correctly. A 551 does not mean "551 out of 1000 points earned" in the way a classroom grade would, and it certainly does not mean 55% correct.

There is no single binary "pass line" in the traditional sense. The meaningful thresholds are 351, where you move from a certificate of completion to the certification diploma, and 551, where a Credly badge is added. For a detailed treatment of these cutoffs, see IC Passing Score. No official candidate pass rate was verified, so be skeptical of any site quoting one; our IC Pass Rate article explains what can and cannot be said responsibly.

Booking, Packages, and Fees

The U.S. public store lists several packages. Package inclusions follow the selected product, so read the product page before you buy.

The incremental cost of a practice assessment is small relative to the exam fee, which is worth considering given that retaking costs money too. For a fuller pricing walkthrough, including how to think about which bundle fits your starting level, see the IC Certification Cost breakdown.

Requirements to sit the exam

No formal education, experience, training, or age prerequisite is specified. What you do need is valid photo identification, and for remote testing, the right equipment. That makes this one of the more accessible credentials in the security space. Details are collected in IC Requirements.

Validity and Retake Rules: Read Carefully

Here the published sources do not fully agree, and an honest explainer should say so rather than smooth it over.

• The exact CyberCitizen blueprint and the directly retrieved U.S. credential page specify three-year validity, with retesting for renewal or score improvement. That U.S. page specifies a minimum 24-hour interval between retakes.
• A generic Tosa FAQ describes lifetime certification with scores becoming outdated after three years, no minimum retake waiting period, and a 551 minimum for other certifications, including digital literacy.

Planning-wise, the safe assumption is to treat the credential as time-limited and to schedule any retake with at least a day of review between attempts. Timing and scheduling considerations are covered in IC Exam Dates.

Who Benefits From This Credential

CyberCitizen is a fit for people who are not security specialists but whose work touches data, accounts, and devices. That covers a wide group:

• Employees in any office role whose employers want documented security-awareness competence across the workforce.
• Students and recent graduates who want a verifiable signal of digital responsibility on a CV, especially with the Credly badge at 551 or above.
• Job seekers moving into roles with data-handling duties, such as administration, customer service, or HR support.
• Career changers exploring whether cybersecurity is a field worth pursuing, using this as a low-barrier first step.

Be realistic about market value: this is an awareness credential, not a specialist security qualification, and we do not publish invented salary figures for it. Our pieces on whether the IC certification is worth it, earnings considerations, and IC-related jobs take a qualitative look at the return on the investment.

Preparing Around the Four Domains

Two official numbers frame preparation, and they are easy to conflate. The credential page recommends around 150 hours of training and practice for a Productive result or higher. The public CyberCitizen Learning Lab course, by contrast, estimates 25-40 hours. These are preparation recommendations, not admission requirements, and neither is the same thing as the 60 minutes of exam time. A candidate who already works comfortably with passwords, updates, and phishing awareness may need far less than someone starting from scratch.

Domain 2 gets its own hands-on week because the exam's in-application format rewards doing, not just reading. The sequence also puts vocabulary first, so later domains make sense. For a full methodology, see our IC Study Guide, and when you want to gauge your readiness against realistic questions, try the IC practice tests on the main site. You can also gauge the overall challenge in How Hard Is the IC Exam? and reinforce key facts with the IC Cheat Sheet. If you would like structured instruction, see the overview at IC Training.

Frequently Asked Questions