Earning Cybersecurity Certifications in the US, Stage by Stage: Exams, Exam Fees and Study Costs (October 2026)

This article assumes you are earning the certifications inside the United States. Taking exams in Japan is out of scope. All amounts are in US dollars, as shown on each organization’s official page when we checked on October 30, 2026. They exclude tax and exchange rates, and prices can change without notice.

We lay out “what to take first” and “what it costs” in three stages: entry, practitioner, and advanced or specialist. We do not claim that a certification gets you a job. Sources are given next to each statement. Totals are my own sums of the prices on the official pages.

Key points

• Exam fees alone: $199 to $439 at entry level, $249 to $1,199 at the middle stage, and $544 to $1,699 at the top.
• Study costs vary far more, from free to about $8,800. Some people prepare with free videos; one course costs $8,780 (SANS SEC401, with the exam sold separately).
• Maintenance comes after the exam. CompTIA charges $150 every three years, ISC2’s CISSP $135 a year, ISACA $45 (member) or $85 a year, and GIAC $499 every four years.
• CompTIA Security+ gets a new version (V8) around November 17. The English version of the current V7 retires on June 11, 2027. We could not confirm the V8 exam fee.
• Three US-specific programs matter: the Department of Defense’s certification rules (DoD 8140), GI Bill reimbursement of exam fees for veterans (up to $2,000 per test), and CompTIA’s discount for US students (35-55%).

The whole picture, in three stages

The order follows the “recommended” notes on each organization’s official page. It is not a required order.

(Maintenance sources: CompTIA renewal fees, ISC2 annual fees, ISACA and GIAC renewal. The experience requirements for CISM, SSCP and CCSP come from each organization’s guide pages.)

Stage 1: Entry

Three options need no work experience.

• ISC2 CC ($199): No work experience is required. The official page lists a two-hour maximum exam.
• Google Cybersecurity Professional Certificate: There is no proctored exam; you pay Coursera’s monthly fee ($49 in the US and Canada, with a 7-day free trial). The page’s guide is “under 6 months at under 10 hours a week”. It says graduates can buy Security+ training and the exam at a discount, but does not give the amount.
• CompTIA Security+ ($439): CompTIA’s next-stage certifications also name it as recommended. PenTest+, for example, recommends Network+ and Security+ or equivalent knowledge. On ISC2’s CISSP page, Security+ is one of the credentials that can stand in for one year of the required experience.

CompTIA’s recommendation for Security+ is Network+ and two years of experience, but that is only a recommendation. Network+ costs $399, according to CompTIA’s page data. A+ is split into two exams, and we could not confirm its fee.

Stage 2: Practitioner

From here the paths split. There is no fixed order; you pick what is close to your job.

• Defense (blue team): CySA+ ($439) targets SOC and vulnerability analysis roles. GIAC’s GSEC ($999) has a retake fee of $899 and an extension fee of $479. SSCP ($249) requires one year of experience.
• Offense (red team): PenTest+ ($439), TCM Security’s PNPT ($499, with training and one retake) and EC-Council’s CEH ($950-$1,199). INE’s eJPT does not show its exam fee on the official page.
• High-cost practical exams: OffSec’s OSCP+ is a 24-hour practical exam. The exam alone is $1,699, and the course bundle with an exam attempt is $1,749 (90 days, one attempt). The annual Learn One plan is $2,749 and includes two attempts (OffSec).

The CEH fee is as shown on EC-Council’s store page, which may be out of date. CEH also requires an eligibility application before you buy.

Stage 3: Advanced and specialist

• CISSP ($749): It requires five years of work experience. If you do not have it yet, you can pass the exam first, become an Associate of ISC2, and then have six years to earn the experience (ISC2). The exam outline changes on April 15, 2027.
• CISM ($575 member, $760 non-member): An ISACA certification. You can take the exam first and show your experience afterward.
• SecurityX ($544): CompTIA’s advanced certification. It recommends 10 years of IT experience, 5 of them in security.

Study costs

Study costs vary far more than exam fees.

CompTIA’s study prices are read from product data embedded in its pages. Check that they match what the page shows before you buy. We could not confirm prices for ISC2’s official training, INE’s eJPT, or Udemy courses.

Building a budget (my own sums)

These are simple sums of exam fees and the study costs above. They exclude retakes and maintenance.

After the three-stage example, CISSP’s $135 annual fee applies every year once you hold it. Whether CompTIA’s $150 renewal is charged per certification when you hold several is something I have not confirmed.

US-specific programs

Department of Defense certification rules (DoD 8140): The DoD decides which certifications it accepts for each work role (DoDM 8140.03). CompTIA says seven of its certifications (A+, Network+, Security+, Cloud+, CySA+, PenTest+ and SecurityX) are approved across 30 work roles (CompTIA). ISC2’s CISSP, SSCP and CCSP pages also carry the DoDM 8140.03 mark. EC-Council says CEH is approved (the organization’s own statement). The DoD’s official list requires a login, so I have not checked it.

GI Bill reimbursement of exam fees: Veterans eligible for the GI Bill can be reimbursed for licensing and certification test fees, up to $2,000 per test. Retakes are covered, but not the fee for the license or certificate document itself (VA). I have not confirmed whether each certification (Security+, CISSP and so on) is an approved test, so check with the VA before you sit it. VET TEC 2.0’s listed fields do not include cybersecurity, and it does not mention exam fees (VA).

Student discount: Students at US four-year institutions (and some two-year ones) can get 35-55% off in the CompTIA store. Student status is verified through SheerID, and the discount cannot be combined with others (CompTIA).

Employer support: CompTIA’s advice is to “check with your employer”.

Reading prices and versions

• CompTIA’s “Retake Assurance” costs $140 more than the plain voucher (Security+: $579 versus $439) and includes one retake.
• ISC2 gives one attempt for the exam fee alone and two attempts within 180 days with its protection option. The retake fee is not on its official pricing page (ISC2).
• Versions are changing. Security+ V8 arrives around November 17. The English CySA+ V3 retires on December 22 (V4 launched June 23). CISSP’s exam outline changes on April 15, 2027 (each organization’s official pages). Around a switch, match your study materials to the version you will sit.
• GIAC states on its pricing page that it can change prices without notice.

What is not confirmed

• The fees for CompTIA A+ and Security+ V8.
• INE’s current eJPT price, which the official page does not show.
• ISC2’s official training prices and its retake fee.
• ISACA’s member dues, which the official page does not display as a price. Members pay $185 less for the exam, but I cannot say whether membership pays off.
• OffSec’s retake fee and the price of Learn Unlimited.
• The CEH practical exam fee and its renewal costs.
• Prices for SANS courses other than SEC401.
• The DoD’s per-role list, and whether the VA approves each specific certification.
• Effects on hiring or salary, which this article does not examine.

Related articles

• Breaches of Member Systems Keep Coming: What the Disclosed Incidents Have in Common, the Methods JPCERT/CC Describes, and What to Check Now: Before studying, know what is actually happening now
• VPNs, Email Gateways and Remote-Support Tools: The Edge Devices Exploited This Month, and What to Check Now: The edge devices that practitioners are asked to check first
• Where PHP2Shell Reports and the Primary Sources Disagree: How to read primary sources, a habit that also helps when you study

If you would like advice on the security of your own site or systems, get in touch.