Security+ Study Schedule for Beginners

Picture a retail supervisor who has decided to move into IT security. She has no networking background, evenings and weekends to study, and one question: how do I organise the next couple of months so I actually sit the CompTIA Security+ exam instead of endlessly "preparing" for it? This article is the timetable she needs — a ten-week schedule (an eight-week core plan plus two optional foundation weeks) built for people starting with little or no IT experience.

One honesty note before the calendar. CompTIA publishes no official study-hours figure for Security+ (SY0-701), and anyone quoting an exact number is guessing. What CompTIA does say is that the exam has no enforced prerequisites but is recommended for people with CompTIA Network+ and around two years in a security or systems administrator role. If that is not you, you are not disqualified — you simply need a schedule that builds the missing groundwork first, which is exactly what the plan below does.

Before week 1: three setup tasks

1. Download the official SY0-701 exam objectives free from comptia.org. Every week below is anchored to its five domains: General Security Concepts; Threats, Vulnerabilities and Mitigations; Security Architecture; Security Operations; and Security Program Management and Oversight. For a plain-English walkthrough of what each domain means, read our Security+ exam objectives breakdown first.
2. Choose one primary study resource (a book or video course written for SY0-701) and stick with it. Beginners lose more time switching resources than they lose to any single imperfect one.
3. Fix your weekly study budget in your diary. The plan assumes roughly five to eight hours a week — for example, three weekday evening sessions of about an hour plus a longer weekend block. If you can only manage less, stretch the plan rather than skipping weeks; consistency beats intensity.

If you are still deciding whether Security+ is even the right first exam for you, that question has its own guide — see which CompTIA certification to start with — and this schedule will still be here when you have decided.

Weeks 1–2 (optional): IT and networking foundations

Skip these two weeks only if you can already explain what an IP address, a port, a server and a firewall are without looking anything up. Security+ constantly assumes this vocabulary, and beginners who skip straight to domain study end up relearning it mid-plan at double the cost.

• Week 1 — how computers and networks talk. IP addressing at a conceptual level, common protocols and ports, what switches, routers and firewalls do, and the difference between a client, a server and a cloud service.
• Week 2 — the security lens. Confidentiality, integrity and availability; what authentication and authorisation mean; what an attack surface is. End the week by re-skimming the objectives document — noticeably more of it should now make sense.

You do not need the full CompTIA Network+ certification before Security+ — CompTIA's recommendation is guidance, not a rule — but if these two weeks feel genuinely enjoyable rather than remedial, the Network+ certification guide is worth a look for later.

Weeks 3–7: one domain per week

The heart of the plan: five domains, five weeks, in an order chosen so each week feeds the next. Work through your primary resource's chapters for that domain, then close every week the same way — write a one-page summary from memory, and answer a set of practice questions restricted to that domain, logging your score.

• Week 3 — General Security Concepts. Control types and categories, core principles, cryptography basics, zero trust vocabulary. This is the exam's shared language; over-invest here and every later week gets cheaper.
• Week 4 — Threats, Vulnerabilities and Mitigations. Threat actors, attack types and their tell-tale indicators. Beginner tactic: build a two-column table as you go — attack on the left, its standard mitigation on the right. It becomes your single best revision asset.
• Week 5 — Security Architecture. Cloud versus on-premises, segmentation, data protection, resilience. This is the hardest week for career-changers because it assumes infrastructure intuition; slow down, draw diagrams, and accept that two passes through the material is normal.
• Week 6 — Security Operations. Hardening, identity and access management, monitoring, incident response. Learn the incident response stages as a story you can retell, not a list you recite — "what happens next?" questions are a Security+ staple.
• Week 7 — Security Program Management and Oversight. Governance, risk management, third-party risk, compliance and awareness. It reads like paperwork; treat it as free marks, because its questions reward precise definitions more than deep technical skill.

Weightings for each domain are printed in the official objectives document — check them there, and if a heavily weighted domain produced your worst end-of-week score, earmark it now for extra attention in week 9.