IIBA CCA study guide
IIBA CCA · Work through your exam, one topic at a time.
The Certificate in Cybersecurity Analysis (IIBA-CCA) is one of the specialized credentials in IIBA's certification portfolio, listed on iiba.org alongside the Agile Analysis Certification (AAC), the Certification in Business Data Analytics (CBDA) and the Certificate in Product Ownership Analysis (CPOA). IIBA positions its seven certifications as a ladder running from foundational to specialized, with the ECBA, CCBA and CBAP covering core business analysis at entry, experienced and advanced levels, and the specialized certificates letting practitioners deepen expertise in a particular domain. The CCA sits in that specialized tier: it is aimed at business analysis professionals who increasingly work on security-related initiatives and want to demonstrate that they can bring analysis discipline to cybersecurity work. IIBA's own published material frames the theme in business analysis terms rather than engineering terms, for example its blog piece on adversarial thinking for business analysts, which argues that you do not need to be a cybersecurity specialist to think like one. IIBA has not published a public domain breakdown, question count, time limit, passing score or fee schedule for the CCA on the page reviewed here, so candidates should confirm those details through IIBA's Steps to Certification, Certification Fees, Exam Information and Certification Handbook pages before booking. To prepare, start from the official exam information and handbook, then use IIBA-endorsed exam prep providers and the KnowledgeHub and Digital Library+ resources included with membership; members also pay reduced exam and renewal rates. Topics on this exam: Cybersecurity Analysis (domain breakdown not published in source). The IIBA CCA study guide has 1 section and about 377 words.
01Cybersecurity Analysis
This domain tests how a business analyst identifies, structures, and communicates security needs during change. It is an analysis discipline: clarify assets, stakeholders, threats, controls, requirements, traceability, and solution evaluation. It is not penetration testing or security engineering, although the analyst must collaborate with those specialists. Treat security as a quality and non-functional requirement with measurable acceptance criteria, not a late technical add-on.
377 words, about 2 minMore study resources for IIBA CCA
- Practice questionsIn cybersecurity business analysis, what does the CIA triad primarily describe?
- FlashcardsCybersecurity analysis definition. The discipline of identifying, evaluating, and prioritizing information risk so security decisions support business objectives, producing documented findings that drive risk treatment and control selection.
- Cheat sheetCybersecurity analysis is the practice of identifying, evaluating, and prioritizing risks to information assets so that security decisions align with business objectives; it produces findings that feed risk treatment, architecture, and control selection.
- Key termsConfidentiality, Integrity, Availability (CIA) Triad. A model describing the three core goals of information security: keeping data private to authorized parties, keeping data accurate and unaltered, and keeping systems and data reachable when needed.
- Study planMap the full Cybersecurity Analysis domain into a personal outline covering business analysis fundamentals applied to security contexts, stakeholder identification, and requirements lifecycle, and locate every concept you cannot yet explain in one sentence.
- Common mistakesThe exam title contains 'Cybersecurity', so candidates over-prepare on firewalls, malware, and attack types and under-prepare on how a BA discovers, models, and validates security needs with stakeholders.
- Exam-day guideBring the exact ID name that matches your registration.