- What Is CCII, Exactly?
- Who Administers the CCII and How It's Delivered
- The Five CCII Exam Domains
- Eligibility Tiers and Who Can Sit for the Exam
- Enrollment, Fees, and Certification Mechanics
- What CCII Exam Questions Actually Look Like
- Who Hires CCII-Certified Professionals
- Keeping the Credential Active
- A Domain-Weighted Approach to Preparing
- Frequently Asked Questions
- CCII stands for Certified Cyber Intelligence Investigator, a board certification from McAfee Institute.
- The exam covers five domains: intelligence analysis, case management, social media investigation, mobile/digital forensics, and e-commerce fraud.
- Passing requires 70% or better on all course sections and the final proctored exam.
- Eligibility is tiered by degree level and years of relevant experience, with a "Qualified" path for those who don't yet meet it.
What Is CCII, Exactly?
CCII stands for Certified Cyber Intelligence Investigator, a board-issued credential built for professionals who investigate crime, fraud, and threats that live inside digital evidence: mobile devices, social media platforms, e-commerce transactions, and online communications. Unlike many cybersecurity certifications that focus purely on defending networks, CCII is investigation-first. It's designed for the person who has to reconstruct what happened, attribute it to someone, and package that finding for a case file, an internal report, or a courtroom.
If you're comparing this credential against others or just trying to understand the name itself, it helps to read a plain-language breakdown of the CCII meaning and what the acronym implies about scope. For a deeper look at the certification body's positioning of the credential, see CCII Certification and What Is CCII Certification?.
Who Administers the CCII and How It's Delivered
CCII is administered by McAfee Institute, a private board-certification organization headquartered in Chesterfield, Missouri. This is not the antivirus company - it's an independent training and credentialing body focused on investigations, intelligence, and cybercrime.
A distinguishing detail candidates often overlook: CCII is not delivered through a third-party testing vendor like Pearson VUE or Prometric. Instead, the entire program - training, quizzes, and the final proctored exam - runs through McAfee Institute's own online platform, available 24/7/365. There's no test center to drive to and no fixed exam date to book months in advance, which changes how you should think about scheduling. If exam-day logistics matter to your planning, the CCII Exam Dates guide walks through how self-paced, on-demand proctoring actually works in practice.
The Five CCII Exam Domains
The CCII body of knowledge is organized into five domains. Every one of the 26 self-study modules maps back to one of these areas, and the final exam draws from all five.
Domain 1: Cyber Intelligence and Intelligence Analysis
Covers the intelligence cycle, source evaluation, and how raw data becomes an actionable finding.
- Distinguishing intelligence from raw information
- Analytical frameworks for threat and behavioral analysis
Domain 2: Cyber Investigations and Case Management
Focuses on how an investigation is structured from intake to closure, including documentation standards and chain of custody.
- Case file organization and evidentiary integrity
- Coordinating multi-party or cross-jurisdiction cases
Domain 3: Social Media Investigation Methodologies
One of the heaviest-weighted domains in the program. Covers OSINT techniques, platform-specific investigation tactics, and identity verification online.
- Sock puppet and undercover account methodology
- Cross-platform identity correlation
Domain 4: Mobile and Digital Forensics
Also among the deepest-covered domains. Focuses on extracting, preserving, and interpreting evidence from mobile devices and digital storage.
- Mobile data extraction fundamentals
- Preserving forensic soundness of digital evidence
Domain 5: E-Commerce, Fraud, Hacking, and Auction Fraud
Covers financially motivated cybercrime, including online marketplace scams, account takeover, and transaction-based fraud schemes.
- Auction and marketplace fraud patterns
- Hacking indicators tied to fraud investigations
Study weight is not evenly distributed. Mobile forensics, social media investigation, and legal fundamentals carry the deepest coverage across the 26 modules, which means Domains 3 and 4 deserve disproportionate attention during prep. For a full breakdown of how each domain is tested and weighted, read the CCII Exam Domains 2026 guide.
Eligibility Tiers and Who Can Sit for the Exam
CCII eligibility is tiered around education and experience, not a single fixed requirement:
- Bachelor's degree or higher + 1 year of relevant experience
- Associate's degree + 2 years of relevant experience
- High school diploma or equivalency + 3 years of relevant experience
Relevant experience includes e-commerce, fraud, investigations, intelligence, military, cybersecurity, law enforcement, forensics, computer/digital forensics, criminal justice, or law. There's also a disqualifying condition worth noting early: anyone convicted of a felony, a crime of moral turpitude, or a misdemeanor involving honesty, theft, embezzlement, or fraud is ineligible for board certification.
If you don't yet meet the experience threshold, you're not locked out. You can complete the training and earn a "Qualified" credential, then purchase the standalone Certified Exam License later to convert to full "Certified" status once you meet eligibility. The complete eligibility breakdown, including how the conversion path works, is covered in CCII Requirements 2026.
Key Takeaway
If your experience is borderline, start the training now under the "Qualified" track rather than waiting - you can convert to full certification later without redoing coursework.
Enrollment, Fees, and Certification Mechanics
Enrollment typically bundles the full 26-module course library, the official manual, a proctored exam license, and the board credential upon completion. Practitioners who already have strong field experience and don't want the training can instead purchase a standalone Certified Exam License. A detailed pricing comparison of both paths is available in CCII Certification Cost 2026.
To actually earn board certification, you must:
- Submit all course quizzes
- Score 70% or better on all sections of the course
- Score 70% or better on the final online proctored exam
- Submit proof of eligibility with your exam application
- Pay all fees in full
Note that the 70% threshold applies twice - once across course sections and again on the final exam - so partial mastery of one module won't be masked by strong performance elsewhere. For the exact scoring mechanics and what counts toward each threshold, see CCII Passing Score 2026.
What CCII Exam Questions Actually Look Like
Because CCII is investigation-focused rather than purely technical, expect questions built around scenarios rather than pure definition recall. A typical item might describe a partial case - a suspicious auction listing, a mobile extraction result, or a social media identity conflict - and ask what the investigator should do next, what evidence type applies, or which methodology fits the situation.
This scenario-based format is why memorizing vocabulary alone under-prepares candidates. You need to recognize how Domain 3 (social media methodology) and Domain 4 (mobile forensics) concepts get applied together in a single case narrative, since real investigations rarely respect clean domain boundaries. For an honest assessment of how challenging this format is compared to other certifications, read How Hard Is the CCII Exam? and review outcome data in CCII Pass Rate 2026.
Who Hires CCII-Certified Professionals
Because the credential is mapped to the NIST NICE Workforce Framework and listed in the CISA NICCS Education & Training Catalog, it's recognized well beyond private-sector security teams. Typical employers and roles include:
- Law enforcement agencies handling digital and cyber-enabled crime
- Corporate fraud and loss-prevention units, especially in e-commerce
- Military and government intelligence functions (the program qualifies for DoD/Navy/Army/Coast Guard/Air Force COOL and Credentialing Assistance funding)
- Private investigation and digital forensics firms
- Insurance and financial fraud investigation teams
The certification is also approved for Missouri POST CLEE credit, which matters for law enforcement professionals tracking continuing education requirements. For a broader look at where CCII holders actually land and what the role landscape looks like, see CCII Jobs and the earnings breakdown in CCII Salary Guide 2026.
| Attribute | Detail |
|---|---|
| Issuing Body | McAfee Institute (Chesterfield, Missouri) |
| Delivery | Fully online, self-study, proctored via McAfee Institute's own platform |
| Course Content | 26 self-study modules, available 24/7/365 |
| Passing Requirement | 70%+ on all course sections and the final proctored exam |
| Validity Period | 2 years, renewable with 20 CPE credits (2 must be ethics) |
| Framework Alignment | NIST NICE Workforce Framework; CISA NICCS catalog listing |
Keeping the Credential Active
CCII certification is valid for two years. Renewal requires 20 CPE credits per two-year cycle, with at least 2 of those hours specifically in ethics. CPE hours are self-reported through McAfee Institute's CPE reporting form, and records must be retained for three years in case of an audit.
If you let certification lapse, there's a 30-day grace period to submit missing CPE credits. After that window closes, the credential is permanently revoked, and reinstating it means purchasing a new exam license and starting the certification process over - not simply catching up on late credits. Building a light CPE-tracking habit right after certification avoids this entirely.
A Domain-Weighted Approach to Preparing
Generic study techniques only help if they're pointed at the right material. Since mobile forensics, social media investigation, and legal fundamentals carry the deepest coverage across the 26 modules, your study calendar should weight those domains heavier than the others rather than splitting time evenly across all five.
Foundations: Domains 1 & 2
- Intelligence analysis frameworks and the intelligence cycle
- Case management structure and documentation standards
Heavy Weight: Domain 3
- Social media OSINT and platform-specific methodology
- Cross-platform identity correlation exercises
Heavy Weight: Domain 4
- Mobile extraction fundamentals and forensic soundness
- Chain-of-custody drills tied to digital evidence
Domain 5 & Integration
- E-commerce and auction fraud patterns
- Scenario practice blending multiple domains
For a structured walkthrough of pacing, module order, and how to sequence quizzes against the final exam, see the CCII Study Guide 2026. And once you've covered the modules, running scenario-based practice on our practice test platform is the fastest way to confirm you can apply domain knowledge under exam-style conditions rather than just recognize terminology.
Before committing the time and fees, it's worth stepping back and asking whether this credential fits your career trajectory at all - a question addressed directly in Is the CCII Certification Worth It? If you're still getting oriented on the basics, related primers like What Is A CCII?, What Does CCII Mean?, and What Does CCII Stand For? cover the same ground from different angles. For structured coursework itself, see CCII Training, and for a condensed reference once you're deep into review, keep the CCII Cheat Sheet 2026 nearby alongside repeated practice runs on the main practice test site.
Frequently Asked Questions
No. CCII is a private board certification issued by McAfee Institute, though it is listed in the CISA NICCS Education & Training Catalog and mapped to the NIST NICE Workforce Framework, which gives it recognition in government and military hiring contexts.
No. The exam is proctored online through McAfee Institute's own platform, available 24/7/365, rather than through a third-party vendor like Pearson VUE or Prometric.
You can still complete the training and earn a "Qualified" credential. Once you meet the eligibility requirements, you can purchase the standalone Certified Exam License to convert to full "Certified" status.
Mobile and Digital Forensics and Social Media Investigation Methodologies carry the deepest module coverage, along with legal fundamentals, so they warrant more study time than the other domains.
You have a 30-day grace period to complete outstanding CPE requirements. After that, the credential is permanently revoked and you'd need to purchase a new exam license to recertify.