31%

Only 31% of cybersecurity leaders say most job applicants are well qualified. ISACA State of Cybersecurity 2026.

ISACA Certified Cybersecurity Operations Analyst (CCOA) certification

Most Applicants Fall Short.
Don’t.

Hiring managers struggle to find analysts who can handle a live incident. CCOA proves you can, with hands-on labs, a hands-on exam and ISACA’s name behind you.

HRD Corp claimableYayasan Peneraju: may be eligibleKL or online

Exam

ISACA CCOA

Course

5 days

Course fee

RM9,500

Exam fee

Included

Next intake

14 Dec 2026

Quick answer

What is ISACA CCOA?

The Certified Cybersecurity Operations Analyst (CCOA) is ISACA’s technical certification for security operations. Launched in January 2025, its four-hour exam mixes 115 multiple-choice questions with 25 performance-based questions that you solve hands-on with open-source tools. It suits early-career analysts with a few years’ experience.

Exam facts verified against isaca.org on 22 Oct 2026

FOR

Early-career analysts and Tier 1 and 2 SOC staff

ROLES

SOC analyst, vulnerability analyst, incident response analyst

SKIP IF

You are new to IT. Start with ISC2 CC, ECSS or Security+

01

The Credential

What you study, practise and sit to earn it.

Pass the CCOA exam, apply to ISACA and you hold the Certified Cybersecurity Operations Analyst credential, from the body behind CISM and CISA. Passing also earns a one-year educational waiver towards CISM.

COURSE

5 days, 5 modules

HANDS-ON

13 performance-based labs

EXAM

4 hrs, 140 items

CREDENTIAL

ISACA CCOA

Awarded by

ISACA

Level

Early career, a few years’ experience

Prerequisites

None to sit the exam

Launched

January 2025

Upkeep

120 CPE hours per 3 years, 20 a year

Bonus

One-year educational waiver towards CISM

02

Decide in 60 Seconds

Four analyst-track options people compare.

If you want to

Choose

Why

Prove hands-on SOC skills in a live exam environment

→

ISACA CCOA

25 performance-based questions on real open-source tools

Work in a SOC built on Cisco technology

→

CCNA Cybersecurity

Focused on monitoring, analysis and incident response

A vendor-neutral baseline before specialising

→

CompTIA Security+

Core security skills that apply to any vendor’s tools

Start from zero experience

→

ISC2 Certified in Cybersecurity

Entry-level credential with no experience needed

Is CCOA your next step?
0/4

Tick what applies. 3 or 4: CCOA is a strong next step. Fewer: build the base with ISC2 CC or Security+ first.

03

What the Exam Covers

Five domains from ISACA’s CCOA exam content outline. Bars to scale.

5 domainsLargest: Incident Detection and Response, 34%140 items, 25 performance-based

Incident Detection and Response 34%
Technology Essentials 25%
Cybersecurity Principles and Risks 20%
Securing Assets 11%
Adversarial Tactics, Techniques and Procedures 10%

Source: ISACA CCOA Exam Content Outline and Exam Candidate Guide (outline effective January 2025).

04

What the Course Covers

Five modules that mirror the five exam domains.

Five days of instructor-led ISACA training. Each module maps to one exam domain, and the labs put every module into practice on a live virtual machine.

3 topics

Technology Essentials

  • Networking models, ports, protocols and segmentation
  • Databases, command line, containers and virtualisation
  • APIs, automated deployment and scripting

3 topics

Cybersecurity Principles and Risks

  • Governance, compliance and risk management
  • Roles, responsibilities and security models
  • Cloud, data, network, supply chain and user risk

3 topics

Adversarial Tactics, Techniques and Procedures

  • Attack vectors and threat actors
  • Threat intelligence sources
  • Attack types, cyberattack stages and exploit techniques

3 topics

Incident Detection and Response

  • Logs, alerts and advanced log analysis
  • Indicators of attack and compromise
  • Containment, forensics and packet analysis

3 topics

Securing Assets

  • Controls, IAM and contingency planning
  • Collecting and documenting incidents
  • Vulnerability assessment, remediation and tracking

13

performance-based labs, each on a virtual machine loaded with the tools analysts use every day.

Incident Management System (SOC Case)Threat Intelligence PlatformSIEM with ElasticDNS and Email/SMTP AnalysisHTTP/HTTPS AnalysisEndpoint Security AnalysisScanning and Analysing VulnerabilitiesWindows LogsAdvanced Log AnalysisIncident ContainmentCollecting and Verifying Data IntegrityCollecting and Documenting IncidentsCyberChef for Security Analysts

05

Why Now

What employers face, the local threat picture, and why train with us.

31%

of cybersecurity leaders say most job applicants are well qualified for the role

ISACA State of Cybersecurity 2026

58%

of organisations say their cybersecurity team is understaffed

ISACA State of Cybersecurity 2026

16%

rise in cyber incidents reported to MyCERT in Q1 2026, to 2,188 cases

MyCERT Cyber Incident Summary Report, Q1 2026

6 hrs

Six Hours to Report. Who’s Watching the Alerts?

Malaysia’s Cyber Security Act 2024 (Act 854) came into force on 26 August 2024. Critical infrastructure entities must report a cyber security incident within six hours, and managed SOC monitoring services now need a licence. Both need analysts who can prove they handle incidents, hands-on.

NACSA; Cyber Security (Notification of Cyber Security Incident) Regulations 2024

ISACA Accredited Elite Partner

Delivering ISACA’s official CCOA training

Exam included

One fee covers training and your exam

HRD Corp registered

This course is HRD Corp claimable

KL or online

Instructor-led in class or live online

06

The Cost, All In

Every figure per person, in ringgit.

Fees

Five-day courseIncluded

ISACA CCOA examIncluded

Funding

HRD Corp claim for employersClaimable

Yayasan Peneraju financing (Bumiputera)May be eligible

Course with exam

RM9,500

Dates

Where

Fee

14 to 18 Dec 2026

Kuala Lumpur or online

RM9,500 incl. exam

25 to 29 Jan 2027

Kuala Lumpur or online

RM9,500 incl. exam

1 to 5 Mar 2027

Kuala Lumpur or online

RM9,500 incl. exam

3 to 7 May 2027

Kuala Lumpur or online

RM9,500 incl. exam

5 to 9 Jul 2027

Kuala Lumpur or online

RM9,500 incl. exam

Training a team? We run private intakes on dates that suit your organisation, with HRD Corp claims handled alongside you.

07

Exam and Renewal

What exam day looks like, and what happens after you pass.

Certification

ISACA Certified Cybersecurity Operations Analyst (CCOA)

Duration

4 hours

Items

115 multiple-choice and 25 performance-based

Passing score

450 on a 200 to 800 scale

Delivery

PSI test centre or remote proctoring

Language

English

Retakes

Up to four attempts in 12 months, with waiting periods

Exam fee

Included in the course fee (ISACA lists US$399 member, US$499 non-member)

KEEP IT ACTIVE

Earn 120 CPE hours

Earn 120 continuing professional education hours over each three-year cycle, with at least 20 a year.

ANNUAL FEE

US$45 or US$85 a year

ISACA’s annual maintenance fee is US$45 for members and US$85 for non-members.

FAQ

Questions People Ask

What is ISACA CCOA?

The Certified Cybersecurity Operations Analyst (CCOA) is ISACA’s technical certification for security operations analysts. It proves you can evaluate threats, identify vulnerabilities and respond to incidents, and it launched in January 2025.

It runs for four hours and combines 115 multiple-choice questions with 25 performance-based questions that you solve hands-on with open-source tools. You need 450 on a scale of 200 to 800 to pass.

At Trainocate Malaysia the five-day course is RM9,500 per person, and the exam is included. ISACA lists the exam alone at US$399 for members and US$499 for non-members. The course is HRD Corp claimable, and Malaysian Bumiputera learners may be eligible for Yayasan Peneraju funding.

There is no prerequisite to sit the exam. ISACA designed CCOA for cybersecurity professionals with a few years of experience, so newcomers should start with ISC2 CC or CompTIA Security+.

Yes. CCOA exam passers earn a one-year educational waiver towards the CISM experience requirement.

Both are analyst-level certifications. Choose CCOA if you want an exam that tests hands-on tasks in a live environment and a path towards ISACA’s CISM. Choose CySA+ if you are building on CompTIA Security+.

Earn 120 continuing professional education hours every three years, with at least 20 each year, and pay ISACA’s annual maintenance fee of US$45 for members or US$85 for non-members.

Prove It Where It Counts

Pick an intake. An advisor confirms your seat, HRD Corp claims and Yayasan Peneraju eligibility with you.

  • Next intake: 14 to 18 Dec 2026
  • RM9,500, exam included

Sources

  1. ISACA: CCOA certification
  2. ISACA: CCOA exam content outline
  3. ISACA: CCOA Exam Candidate Guide (PDF)
  4. ISACA: Maintain CCOA certification
  5. ISACA: CCOA launch press release
  6. ISACA: State of Cybersecurity 2026 report coverage
  7. ISACA: Industry leaders pinpoint workforce challenges (2026)
  8. ISACA: Exam Candidate Guide v1.26 (PDF)
  9. ISACA: CISM
  10. Trainocate: CCOA course outline
  11. CyberSecurity Malaysia: Q1 2026 Cyber Incident Summary Report
  12. NACSA: Cyber Security Act 2024 (Act 854)
  13. MAICSA: Act 854 regulations summary