Certification policy

Effective date: 1 December 2026

This policy sets out how IDCC certifications are earned, kept and withdrawn. A certification is only worth something if the exam is fair and holders behave with integrity. This policy is part of our terms of service.

1. Certifications and fees

Who can sit: the Associate exam is open to anyone. Professional: at least 5 years of work in cybersecurity before the exam.

2. Exam vouchers

1. One voucher covers one exam attempt. It is valid for 12 months from purchase.
2. Online exams are not open yet. When they open, we will email everyone holding a voucher, and the 12-month validity period will start from that date.
3. If online exams have not opened within 6 months of your purchase, you can get a full refund for unused vouchers. Otherwise, a voucher is not refundable once you start the exam.
4. Vouchers bought on a team plan can be reassigned to another learner at the same customer company.

3. Exam rules

• Register at least 14 business days before the date you want to sit the exam.
• Exams run online in our own web-based lab environment, so you can sit them from anywhere. We do not use an outside testing company.
• We check your identity with official photo ID before the exam.
• AI proctoring software watches your webcam, microphone and screen during the exam and flags possible rule breaks. A member of our staff reviews every flag before any result is withheld. We use the recording only for this, and delete it after 90 days.
• No notes, books, help from others, AI tools or other websites, unless the exam instructions allow them.
• Don't record, share or publish exam questions, during or after the exam.
• If you need accommodations, for example because of a disability, tell us when you register.

4. Results and retakes

• Pass mark: 80% of questions answered correctly. We email your result when scoring is complete.
• If you don't pass, you can retake after 14 days, up to 4 attempts per calendar year. Each retake needs a new voucher, unless it is one of the attempts included in an annual Professional or Team Professional plan.
• You can ask a person to review your score within 30 days.

5. Keeping your certification

• A certification lasts 3 years. Each year, pay the annual maintenance fee and log 30 hours of continuing professional education (CPE). Hands-on work in cybersecurity counts: we want holders to be active practitioners, so your regular job in the field can make up your CPE hours alongside courses, conferences, research and teaching.
• If the annual fee is unpaid or you have not logged the required CPE hours, the certification is suspended. You then have 90 days to put it right; if you don't, the certification is withdrawn.
• To renew for another 3 years, before it expires you need 90 CPE hours in total and a one-page statement of your cybersecurity work over the previous 3 years.

6. Verification

Every certification has a number. Employers and others can use it to check that a certification is genuine and current. A check shows only the holder's name, the certification, the date earned, the expiry date and the status.

7. Code of ethics

Certification holders agree to:

• use security techniques only where they are authorized, and obey the law;
• keep confidential what they learn in their work;
• be honest about their credentials and experience;
• report vulnerabilities they find responsibly to the people affected.

8. Revocation and appeals

We may revoke a certification, and bar its holder from future exams, for cheating, leaking exam content, or a serious breach of the code of ethics or of the lab rules. Before revoking, we tell the holder why and give them a chance to respond. They can appeal within 30 days of our decision, and someone who was not involved in the original decision reviews it.