CompTIA Security+ certification: history of the exam [updated 2021]

CompTIA continues to rework the Security+ certification curriculum that establishes the core knowledge to keep cybersecurity professionals prepared for evolving attacks and cyberthreats. This credential can help professionals in any career path become more well-rounded and be equipped with the skills necessary to secure today’s complicated business computing landscape.

The latest version of this exam, SY0-601, adds a focus on current technologies including cloud, mobile and IoT. It was updated to address “the latest trends and techniques — covering the most core technical skills in risk assessment and management, incident response, forensics, enterprise networks, hybrid/cloud operations and security controls, ensuring high-performance on the job.”

Become a SOC Analyst: get Security+ certified!

More than 47,000 new SOC analysts will be needed by 2030. Get your CompTIA Security+ to leap into this rapidly growing field — backed with an Exam Pass Guarantee.

View Pricing

History of the Security+ exam

Around the year 2000, there was a need for an entry- to intermediate-level certification for professionals pursuing a career in information security. Specifically, there was not a good springboard to intermediate-level security certifications for individuals interested in seriously pursuing a career in information security. CompTIA launched the Security+ certification in 2002 to address this need.

The guiding vision of Security+ is to test what is generally assumed to be the capabilities and skills held by a professional with two years of full-time work experience. The credential can bring a significant boost to the certification holder’s competitiveness on the job market and is a positive investment for many career paths, including, security administrator, network/cloud engineer, helpdesk manager/analyst, systems administrator, junior IT auditor/penetration tester, DevOps/software developer, IT project manager or security engineer/analyst.

2008 update: CompTIA Security+ SY0-201

Much like information security itself, Security+ is continuously evolving and needs to keep up with the constantly changing cybersecurity landscape. The first Security+ exam version was SY0-101 and was used until 2008 when the revised exam, SY0-201, premiered. This new version of the Security+ exam included a new focus on systems security, network infrastructure, organizational security, methods for access control, audits and cryptography. SY0-201 was available for exam takers until the end of 2011. 

2011 update: CompTIA Security+ SY0-301

In May of 2011, CompTIA released the second major revision of Security +, SY0-301. This version was launched with some significant changes, including new concepts such as cloud computing, threat administration and mitigation, as well as other recent developments in the field of information security. SY0-301 expired at the end of 2014.

As of Jan. 5, 2013, the Security+ exam began to include a performance-based exam portion requiring the candidate to perform tasks or solve problems within a simulated information technology environment, followed by corresponding questions focused on different scenarios. 

2014 update: CompTIA Security+ SY0-401

In May of 2014, CompTIA released Security+ exam version SY0-401. This new version of Security+ shifted focus yet again, this time with an emphasis on access control and identity management. This version of the Security+ certification exam expired in July 2018. 

2017 update: CompTIA Security+ SY0-501

Then came SY0-501. Released in October 2017, the exam content changed by about 25% from SY0-401. These changes included an increased emphasis on cyberattacks, risk management and best practices. The reason for the increased cyberattack coverage was due to the increase in distributed denial of service attacks (DDoS), ransomware, phishing and email attacks. In the last few years, these attacks have become more varied, sophisticated and successful, making it more important than ever for information security professionals to effectively identify and neutralize them.

2020 update: CompTIA Security+ SY0-601

The current version of Security+, SY0-601, has been available since Nov. 12, 2020, and, once again, CompTIA modified exam domains to reflect what’s happening in the industry. This exam consists of the following five domains: 

• Attacks, threats and vulnerabilities (24%) — Ability to recognize and understand the different sources of threats, types of attacks and vulnerabilities that may be exploited
• Architecture and design (21%) — Knack to apply security controls in practice to create a safe environment for company operations
• Implementation (25%) — Competence in implementing secure system design to safeguard aspects related to hardware/firmware security, operating systems and peripherals
• Operations and incident response (16%) — Expertise to respond adequately to a cybersecurity incident and devise appropriate continuity strategies that can provide businesses with a level of resiliency and operational insurance to withstand unexpected threats
• Governance, risk and compliance (14%) — Familiarity with a comprehensive governance, risk and compliance (GRC) program that aligns with the strategy to securely enable and support the business, both in terms of optimization and clarity

To successfully pass the CompTIA Security+ certification, candidates must prove they have several skills: 

• Assess the security posture of an enterprise environment and recommend and implement appropriate security solutions
• Monitor and secure hybrid environments, including cloud, mobile and IoT
• Operate with an awareness of applicable laws and policies, including principles of governance, risk and compliance
• Identify, analyze and respond to security events and incidents

Change is constant

Today, the CompTIA’s Security+ certification is considered one of the leading vendor-neutral credentials to validate the baseline skills needed to prove knowledge of core IT security-related functions. It covers systems installation, configuration, securing devices, applications, networks, knowledge of cyberthreats and analyses, risk mitigation techniques, familiarity with different cyber laws, policies and regulations.

The credential was born to validate the skills of information security professionals. Security+ has effectively evolved with the changing information security field by updating its exam objectives and will continue to launch careers of professionals going forward into the future.

 Sources

• Security+, CompTIA, Inc.
• Exam Objectives, CompTIA, Inc.
• The NEW CompTIA Security+: Your Questions Answered, CompTIA, Inc.
• The Security+ Certification's Evolution and Remake Over 10 Years, Pearson IT Certification
• Why Security+ Is Right for You, Especially Since Its Remake, Pearson IT Certification
• Security+ Detailed Mapping SY0-401 vs SY0-501, CompTIA, Inc.
• Security+ 501 vs. 601: What’s the Difference?, CompTIA, Inc.