CCA logo
Focused certification exam prep
Start practice

CCA Exam Dates 2026: Testing Windows, Deadlines & Scheduling

TL;DR
  • IIBA-CCA is delivered on-demand through PSI remote proctoring - there is no fixed 2026 testing window.
  • Once purchased, your exam voucher must be used within 6 months, so plan backward from that deadline.
  • The exam is 75 multiple-choice questions in 90 minutes across eight domains.
  • Members pay USD 250 to sit the exam; non-members pay USD 405, which includes first-year IIBA membership.

How the IIBA-CCA Exam Is Delivered

Before you can plan a testing date, it helps to understand how the Certificate in Cybersecurity Analysis (CCA) is actually administered. IIBA-CCA, developed by the International Institute of Business Analysis in collaboration with the IEEE Computer Society, is not offered on a handful of fixed dates per year like some paper-based professional exams. Instead, it is delivered through PSI's online remote-proctored testing platform, which means candidates schedule their own appointment at a time that fits their calendar - including evenings and weekends - rather than waiting for a designated "testing window."

This is one of the most important distinctions to understand when researching "CCA exam dates 2026": there is no single national test day. There is a rolling calendar of appointment slots, and your job is to pick the slot that lines up with your preparation timeline, not the other way around. If you're still building your study plan, our CCA Study Guide 2026 walks through how to reverse-engineer a prep schedule from your target test date.

No Fixed Test Dates: Because IIBA-CCA uses PSI's remote-proctored, on-demand scheduling model, there are no quarterly or annual "testing windows" to track. Availability is driven by PSI appointment slots, not by an IIBA release calendar.

2026 Testing Windows: How CCA Scheduling Actually Works

Because the exam is offered continuously through PSI rather than in batches, "2026 testing windows" really means understanding the mechanics of appointment booking rather than memorizing calendar dates. Here's the practical sequence:

  1. Purchase your exam through your IIBA account, either as a standalone exam or bundled into the optional learning-and-exam package.
  2. Receive your eligibility ID and scheduling instructions from IIBA, which you then use to book a session with PSI.
  3. Select an available time slot on PSI's remote-proctoring calendar - subject to system availability, which can vary by day and time zone.
  4. Complete identity verification and environment checks shortly before your scheduled session begins.

Because scheduling is self-directed, candidates effectively create their own "testing window" the moment they book an appointment. The real deadline that matters is the one attached to your purchase, not a date on IIBA's public calendar. That's covered next.

Registration Timeline and Deadlines

Many candidates searching for "CCA exam dates" are really asking, "how far in advance do I need to plan?" A reasonable working timeline looks like this:

  • Confirm eligibility and account setup - verify your IIBA profile is active and review the 2026 IIBA-CCA Handbook for the current domain blueprint and policies. If you're unsure whether you meet the eligibility criteria, review CCA Requirements 2026 first.
  • Purchase the exam or the learning-and-exam package once you have a realistic study runway in mind.
  • Book a PSI appointment for a date that gives you enough runway to finish studying all eight domains, but early enough that you're not racing the six-month expiration.
  • Build in a buffer for a possible reschedule, since remote-proctoring slots can fill quickly around evenings and weekends.

The single hardest deadline in this entire process is the six-month completion window attached to your purchased exam. If you buy your exam attempt in January 2026 but don't schedule and sit it before the window closes, you lose the attempt and the fee. Treat that six-month mark as your true "exam date deadline" for 2026 planning purposes.

Key Takeaway

Don't purchase your exam the moment you start studying. Purchase it once you can realistically commit to sitting it within six months - otherwise the clock works against you.

Fees, Retakes, and the Six-Month Clock

Scheduling decisions are inseparable from cost decisions, so it's worth laying out exactly what you're paying for at each stage. A full cost breakdown lives in CCA Certification Cost 2026: Complete Pricing Breakdown, but the numbers that affect your scheduling choices are:

ItemIIBA MemberNon-Member
Standalone ExamUSD 250USD 405 (includes first-year membership)
Retake ExamUSD 195USD 350
Learning + Exam Package (optional)USD 395USD 550

Two scheduling implications follow directly from this table:

  • Non-member exam pricing includes IIBA membership, so if you're not already a member, factor in the paperwork and account setup that comes with new membership before you can book your PSI slot.
  • Retakes are cheaper than the first attempt, but still a real cost. Scheduling your original attempt for a date when you're genuinely exam-ready - rather than the earliest available slot - is the more economical strategy. See CCA Passing Score 2026 for what "exam-ready" should mean in terms of mastery across domains.

Results are reported strictly as pass/fail, with no scaled score breakdown, so there's no partial-credit scheduling strategy to exploit - you either pass on a given appointment or you book a retake.

Mapping the Eight Domains to Your Scheduling Decision

The 2026 IIBA-CCA Handbook defines eight examination domains (not to be confused with the nine courses in the optional learning program - a common point of confusion). Understanding domain weighting is essential to deciding when you're actually ready to book, rather than just when a slot happens to be open.

Domain 5: Data Security (15%) and Domain 6: User Access Control (15%)

These are the two heaviest domains on the exam and deserve the largest share of your final study weeks before you lock in a test date.

  • Data classification, encryption concepts, and data lifecycle protections
  • Authentication, authorization, and identity/access governance models

Domain 1: Cybersecurity Overview and Basic Concepts (14%) & Domain 2: Enterprise Risk (14%)

Together these make up nearly a third of the exam and are typically the earliest domains candidates tackle.

  • Foundational terminology, threat/vulnerability concepts, CIA triad
  • Enterprise risk frameworks, risk assessment and treatment approaches

Domain 7: Solution Delivery (13%), Domain 3: Cybersecurity Risks and Controls (12%), Domain 8: Operations (12%)

A meaningful mid-tier cluster that ties technical controls to real operational and delivery contexts.

  • Security in the solution delivery lifecycle
  • Control types, risk mitigation strategy, day-to-day security operations

Domain 4: Securing the Layers (5%)

The smallest domain by weight - still testable, but not where you should spend disproportionate prep time as your date approaches.

  • Network, application, and infrastructure layer security concepts

For a deeper breakdown of each domain with subtopics and sample question angles, see the CCA Exam Domains 2026: Complete Guide to All 8 Content Areas. If you're trying to gauge whether you're ready to book at all, How Hard Is the CCA Exam? and CCA Pass Rate 2026 both offer useful context on what "ready" looks like.

A Sample Scheduling-Aware Study Timeline

Rather than booking a date first and hoping your studying catches up, work backward: estimate how many weeks you realistically need, then book your PSI appointment for the end of that window - with a short buffer.

Weeks 1-2

Foundational Domains

  • Cybersecurity Overview and Basic Concepts
  • Enterprise Risk
Weeks 3-4

Highest-Weight Domains

  • Data Security
  • User Access Control
Weeks 5-6

Operational and Delivery Domains

  • Solution Delivery
  • Cybersecurity Risks and Controls
  • Operations
Week 7

Lightweight Domain + Full Review

  • Securing the Layers
  • Timed 75-question practice run
Week 8

Book PSI Appointment & Final Review

  • Schedule your remote-proctored session
  • Light review only - avoid new material

This is a general structure, not a rigid formula - some candidates with related security backgrounds may compress it, while others spread it over a longer stretch. The point is to let your domain mastery, not an arbitrary calendar date, determine when you book. For structured content mapped to this timeline, check CCA Training resources and pair them with timed practice questions.

What to Expect on Exam Day

Once you've booked your PSI slot, the logistics on exam day are straightforward but strict. The remote-proctored format requires:

  • A valid form of identification matching your registration details
  • A compatible computer with a functioning webcam and microphone
  • A secure, private testing environment free of other people and materials
  • No reference materials, calculators, or scheduled breaks during the 90-minute session

You'll answer 75 knowledge-based multiple-choice questions in 90 minutes - a pace of roughly 72 seconds per question, which leaves little room for lengthy deliberation on any single item. Because there's no break permitted, treat your exam-day slot as a single uninterrupted commitment: hydrate, use the restroom, and clear distractions before your session starts, not during it.

Ethics Agreement: Before sitting the exam, candidates agree to IIBA's ethics and professional standards. This isn't a testable domain, but it is a required acknowledgment as part of the registration and scheduling process.

After you submit your final answer, results are reported as pass/fail - there's no numeric score report to interpret. If you pass, no further action is needed: the Certificate in Cybersecurity Analysis does not expire and carries no recertification or CDU requirement, so your scheduling obligations end the moment you pass. If you don't pass, you'll need to purchase a retake at the reduced retake fee and go through the PSI scheduling process again. For a broader view of whether the investment of time and fees makes sense for your career stage, see Is the CCA Certification Worth It? and CCA Salary Guide 2026.

To sharpen your timing and question instincts before locking in a date, run full-length timed simulations on our CCA practice test platform - it's the closest way to rehearse the actual 90-minute, 75-question pressure before you're sitting in front of a live proctor. Many candidates also keep a condensed CCA Cheat Sheet 2026 handy during the final review week, not for use during the exam itself, but to consolidate last-minute recall the night before.

Frequently Asked Questions

Are there fixed CCA exam dates for 2026?

No. IIBA-CCA is delivered through PSI's remote-proctored, on-demand scheduling system, so candidates book individual appointments rather than sitting the exam on fixed calendar dates.

How long do I have to schedule my exam after purchasing it?

Your purchased exam must be completed within six months. If you don't schedule and sit it within that window, the attempt and fee are forfeited.

How long is the CCA exam and how many questions does it have?

The exam consists of 75 knowledge-based multiple-choice questions with a 90-minute time limit, delivered via PSI's remote-proctoring platform.

What happens if I fail and need to reschedule?

You can purchase a retake at USD 195 (members) or USD 350 (non-members) and book a new PSI appointment through the same scheduling process.

Do I need to schedule recertification exams later?

No. The Certificate in Cybersecurity Analysis does not expire and requires no recertification or continuing development units, so there's no future exam date to plan for once you pass.

Ready to pass your CCA exam?

Put this into practice with free CCA questions across every exam domain.