CompTIA CySA+ Certification Guide

Anyone researching the CompTIA Cybersecurity Analyst certification (CySA+) in 2026 hits an immediate complication: two exam versions are live at once. CS0-004 launched on 23 June 2026, while CS0-003 is in its sunset window — the English CS0-003 exam retires on 22 December 2026, with translated versions running until March 2027. So before anything else, the question this guide must answer is not "what is CySA+?" but "which exam should I book?" — and the answer shapes everything from the study materials you buy to the deadline you work to.

This is the full reference for the certification: the version decision, what the exam tests domain by domain, format and scoring, requirements, cost, renewal, and a preparation plan built around the domain weightings. Two neighbouring questions have their own dedicated guides: whether the certification actually pays off for analyst hiring is covered in is CompTIA CySA+ worth it, and the "which first, in what order" question against Security+ is settled in Security+ vs CySA+.

CS0-003 or CS0-004: which exam should you sit?

As of August 2026, both versions grant the identical "CompTIA CySA+" credential — exam codes never appear in the certificate name — and your certification is valid for three years from your pass date regardless of which version you passed. The decision is therefore practical, not reputational:

• Choose CS0-004 if you are starting your preparation now. It is the current version, its materials will remain relevant for the exam's whole life, and you face no deadline pressure. At launch it is available in English, with other languages listed by CompTIA as coming later.
• Finishing CS0-003 prep makes sense only with a near-term exam date. If you are already deep into CS0-003 study, the English exam remains bookable until 22 December 2026. The risk is obvious: any slip in your schedule collides with a hard retirement date, and CompTIA's English CS0-003 learning products retire even earlier, on 22 November 2026.
• Do not start CS0-003 from scratch. New candidates buying materials today for an exam that retires within months are volunteering for deadline risk with no offsetting benefit.

The remainder of this guide describes the current CS0-004 exam unless stated otherwise.

What CySA+ is — and where it sits in a security career

CySA+ is CompTIA's intermediate, vendor-neutral certification for the blue-team analyst: the person who monitors, detects, investigates and responds rather than the one who builds infrastructure or breaks into it. It maps most directly onto security operations centre (SOC) analyst and vulnerability analyst roles, where the daily work is triaging alerts, hunting through logs, prioritising vulnerabilities and writing up incidents for people who were not in the room.

Within CompTIA's security track, it occupies the step above Security+. There are no enforced prerequisites — nothing stops you registering tomorrow — but CompTIA's recommended profile is demanding: around four years in a SOC analyst or vulnerability analyst role, with Network+ and Security+ level knowledge assumed. Read that as a description of the exam's pitch, not a gate. Questions presume you already understand core security concepts and networking; CySA+ tests whether you can apply them under analyst conditions.

The requirements question, answered plainly

Because "CySA+ requirements" is one of the most-searched phrases around this certification, here is the precise position: required — nothing; recommended — approximately four years of hands-on analyst experience plus Security+ and Network+ level knowledge. Candidates well short of that profile do pass, but they compensate with lab time. What you cannot compensate for is having never looked at real logs, alerts or vulnerability scan output, because the performance-based questions are built from exactly those artefacts.

The four CS0-004 domains, and what each really asks of you

CompTIA publishes the complete objectives free on its CySA+ page; download them before buying anything else. The domain structure tells you where to spend your hours:

Security Operations — 34%

The largest domain, and the heart of the analyst job: monitoring, detection and the interpretation of security data. Expect to demonstrate that you can look at output — log excerpts, alerts, indicators — and say what is happening and what matters. If your background is study rather than SOC shifts, this domain is where lab practice pays off most.

Vulnerability Management — 26%

Scanning, interpreting results, prioritising findings and understanding remediation in context. The tested skill is judgement: given a set of vulnerabilities, which one threatens this environment most, and what do you recommend? Candidates who only memorise scoring terminology, without practising prioritisation decisions, feel this domain's weight on exam day.

Incident Response & Management — 24%

The lifecycle of an incident from detection through containment to recovery and lessons learned. Scenario questions dominate: something has happened, evidence is in front of you, and the exam wants the appropriate next action — not a recited framework.

Reporting & Communication — 16%

The smallest domain and the most underestimated. Analysts exist to make findings usable by other people, and the exam tests whether you know what belongs in vulnerability reports and incident communications, and for which audience. Do not let its size tempt you to skip it; at these weightings, no domain is optional for a comfortable pass.