What Is IC Certification?

What Isograd CyberCitizen Actually Is

Isograd CyberCitizen is a certification that measures everyday cybersecurity competence for people who are not necessarily security professionals. It tests whether a candidate understands how digital threats work and can protect data, accounts, and devices in ordinary work and personal life. If you are searching for a plain answer to "what is IC certification," this is it: a practical, user-level cyber hygiene credential, not a specialist engineering qualification.

That distinction matters because the acronym "IC" is shared by several unrelated credentials in the wider certification world. On this site, IC refers only to Isograd CyberCitizen. Nothing here applies to any other certification that happens to abbreviate the same way. For a quick orientation on the terminology itself, see our explainers on what IC stands for and IC meaning.

Who Runs It and What the Name Means

The certification is governed and administered by Isograd, which operates the Tosa assessment brand. The current public-facing name is Tosa CyberCitizen, while "IC" is simply the identifier used on this site. You will therefore see "Tosa CyberCitizen" on the official credential page and in the store, and it is the same certification you are preparing for here.

The exam content is defined by the Tosa CyberCitizen Exam Blueprint, a 24-page document. The blueprint is visibly undated, and its file metadata does not establish a published exam-version designation, so treat the linked current blueprint as the controlling reference rather than older frameworks you may find indexed elsewhere. Our complete guide to all four IC content areas walks through how those headings map to real study topics.

Exam Format: 35 Adaptive Questions in 60 Minutes

The certification exam consists of 35 adaptive questions with a 60-minute limit. "Adaptive" means the platform adjusts to your performance as you go, so two candidates will not necessarily see the same questions. The question types are mixed:

• Multiple-choice questions testing recognition of correct practices and concepts.
• Interactive questions that ask you to manipulate or arrange elements on screen.
• In-application questions that place you in a simulated software environment and require you to perform a task.

The in-application and interactive formats are what separate this exam from a pure vocabulary quiz. You may be asked to act, such as adjusting a setting, rather than merely identify a definition. Candidates who have only memorized terms tend to be surprised by this, a point we explore in our difficulty breakdown.

The exam is offered in English and French. Delivery is closed book and proctored throughout, with no breaks and no outside materials permitted.

Do not confuse the exam with the assessment

The current brochure also describes a separate assessment of 25 questions and 40 minutes. That is a different product from the certification exam of 35 questions and 60 minutes. The brochure does not establish what the shorter assessment is used for, so do not assume it carries the same weight or outcome as the certification exam.

The Four Exam Domains

The blueprint organizes the exam into four domains. No percentage weights are published, so you cannot prioritize by weighting; you need working competence across all four.

Note that the public Learning Lab course is a preparation aid, but its curriculum does not replace the four formal exam domains and should not be treated as exhaustive coverage of what can be tested. Anchor your study to the blueprint headings, and use our one-page IC cheat sheet for a fast final review.

How Scoring Works: Bands, Not Percentages

Scoring uses item response theory on a 1-1000 proficiency scale. Because the exam is adaptive, your result reflects the difficulty of the questions you handled correctly, not a simple count of right answers. This means the figure on your report is a scaled proficiency score, not a percentage of questions correct, and you should not try to convert it into one.

The practical threshold to understand is the split at 351 and 551. A score of 351 or above earns the certification diploma; reaching 551 or above adds the shareable Credly badge. If your goal is a visible, verifiable credential for a profile or CV, the badge tier is the one to aim for. For more on how to interpret these bands, read our IC passing score guide. We have not verified any official candidate pass rate, so be wary of any site quoting one; our pass rate article explains what can and cannot be said.

Booking, Packages and Fees

No formal education, experience, training, or age prerequisite is specified, so there is no gatekeeping step before you book. You do need valid photo identification on exam day. Testing runs on the Tosa/Isograd platform through approved Tosa centers or via remote proctoring, including Integrity Advocate. In the U.S., English-language CyberCitizen is supported at Prometric centers.

Remote delivery requires a computer, a webcam, a microphone, and an internet connection. Check your setup well before exam day, because the session is proctored throughout and there are no breaks.

U.S. store packages

The U.S. public store lists the following options. Package inclusions follow the product you select, so read the product page before you pay.

The price gap between the exam-only package and the course-bundled ones is the main decision. If you are comfortable with the topics and just need the credential, the lower tiers may suffice; if you want structured learning, the Skill Builder options bundle it. Our full pricing breakdown compares these choices, and our requirements guide covers eligibility and ID details.

Validity, Retakes and a Policy Conflict to Verify

Here the published sources do not fully agree, and it pays to be careful.

• The exact CyberCitizen blueprint and the directly retrieved U.S. credential page specify three-year validity, with retesting used for renewal or score improvement. That U.S. page specifies a minimum 24-hour interval between retakes.
• The general Tosa FAQ describes a different picture: lifetime certification where scores become outdated after three years, no minimum retake waiting period, and a 551 minimum for other certifications including digital literacy.

Who Benefits From This Credential

Because the content targets general users rather than security specialists, the credential suits a broad audience: office staff, students, career changers, and anyone whose job involves handling accounts, data, and devices. It can serve as evidence of baseline security awareness for employers who want staff to meet a common standard, and as a CV line for candidates entering roles where digital hygiene matters.

It is worth being realistic. A user-level credential like this does not by itself qualify someone for a dedicated security engineering role, and we avoid quoting salary figures for it. For a grounded view of how it fits into hiring, see our IC jobs overview, the salary guide, and our worth-it analysis.

Sequencing Your Preparation by Domain

Preparation time is separate from exam time. The credential page recommends around 150 hours of training and practice for a Productive-level result or higher, while the public CyberCitizen Learning Lab course estimates 25-40 hours. These are recommendations, not admission requirements. If your target is simply the diploma, you may need less; if you want the badge tier, lean toward the higher end.

Because there are no published weights, order your study by dependency rather than by importance:

For a full walkthrough, our IC study guide expands on this approach. When you are ready to test yourself, try the question bank on the main practice test site to rehearse the mixed question styles under realistic time pressure.

Frequently Asked Questions

If you want more background on the terminology, our pages on what IC certification is and IC training options go deeper on the fundamentals.