Skip to content

What is CompTIA CySA+ (CS0-003)?

CompTIA CySA+ — short for Cybersecurity Analyst — is a vendor-neutral, intermediate, defensive (blue-team) certification from CompTIA (the Computing Technology Industry Association). It validates the skills a Security Operations Center (SOC) analyst uses to detect, analyze, and respond to threats: ingesting and interpreting logs, hunting for malicious activity, managing vulnerabilities, running the incident-response process, and communicating findings to stakeholders. This hub is built on exam CS0-003 (V3), whose English exam retires 2026-12-22; its successor CS0-004 (V4) launched 2026-06-23 (see the version notice). This page explains what the credential is, who it is for, the experience CompTIA recommends, and where it sits in a learning path — including how it relates to this repo's offensive (CEH) and Privileged Access Management (PAM) material.

Unofficial & no fabrication. This hub is not affiliated with or endorsed by CompTIA. Exam specifics come from CompTIA's official CySA+ page; anything volatile (exam code, retirement date, price, renewal/Continuing Education terms, DoD mapping) is flagged "verify on CompTIA" and should be re-checked there before you rely on it. Compiled 2026-06-20.

Learning objectives

After working through this page you should be able to:

  • Explain what CySA+ is and who issues it (CompTIA).
  • Describe what vendor-neutral, intermediate, and defensive/analyst mean for this credential.
  • Identify who CySA+ is for and the experience CompTIA recommends.
  • Place CySA+ in a sysadmin-to-SOC-analyst path, after Security+.
  • Relate CySA+ (detection/response) to this repo's CEH offense and PAM access-control defense.
  • Summarise its US Department of Defense (DoD) 8140 relevance and where to confirm it.

Who issues CySA+? (CompTIA)

CySA+ is produced by CompTIA (the Computing Technology Industry Association), a non-profit trade body and one of the largest vendor-neutral IT certification providers. Within CompTIA's security track, CySA+ sits between the foundational Security+ and the advanced CASP+/SecurityX, alongside the offensive PenTest+.

Always treat the official CompTIA CySA+ page as the authoritative source for the current exam code, format, languages, price, and renewal terms, because these change between exam versions: https://www.comptia.org/en-us/certifications/cybersecurity-analyst/ (version pages: V3 / CS0-003 · V4 / CS0-004).

"Vendor-neutral", "intermediate", and "defensive" — the core idea

Three properties define where CySA+ fits:

  • Vendor-neutral — it is not tied to a single product. It teaches the analyst's reasoning (how to read a SIEM alert, correlate logs, scope an incident) rather than how to operate one vendor's console. This contrasts with vendor product certifications, which certify a specific product (for example a particular Privileged Access Management (PAM) platform).
  • Intermediate — it sits a level above the foundational Security+. It assumes you already know the vocabulary (CIA triad, controls, cryptography, Zero Trust) and goes deeper into applying it operationally: analyzing real indicators, prioritizing vulnerabilities, and running response.
  • Defensive (blue-team / analyst) — CySA+ is built around the SOC analyst role: monitoring, detection, threat hunting, vulnerability management, and incident response. Offensive techniques appear only as threats to detect and counter, never as weaponized how-tos.

For a systems administrator moving to a blue-team role: CySA+ formalizes the analyst workflow on top of skills you may already touch — reading logs, patching, watching alerts. It names and structures the day-to-day work of a SOC.

Who CySA+ is for

CySA+ suits people moving into a detection-and-response role, including:

  • SOC analysts (Tier 1 / Tier 2) and security operations staff.
  • Threat-intelligence and threat-hunting analysts.
  • Vulnerability-management analysts and security engineers.
  • Incident-response handlers and triage analysts.
  • Systems and network administrators moving into a blue-team role (this hub's primary audience) who already have Security+ or equivalent knowledge.

CompTIA recommends — but does not require — the following before attempting CySA+:

Recommendation Detail
Prior certification Network+, Security+, or equivalent knowledge (CS0-003 / V3 page)
Hands-on experience CS0-003: a minimum of 4 years of hands-on experience as an incident response analyst, SOC analyst, or equivalent. CS0-004: "About 4 years in a SOC analyst or vulnerability analyst role"

These are guidance, not gatekeeping: there is no mandatory prerequisite exam or formal eligibility application. A sysadmin's existing operating-system, networking, and logging knowledge maps directly onto the material. See exam-and-objectives.md for the full exam detail.

Where CySA+ sits in a certification path

CySA+ is typically taken after Security+, as the defensive specialisation that turns foundational breadth into operational analyst skill.

flowchart LR
    Sysadmin(["Sysadmin / IT<br/>background"]) --> SecPlus["CompTIA Security+<br/>(foundational)"]
    SecPlus --> CySA["CompTIA CySA+<br/>(intermediate,<br/>SOC analyst)"]
    SecPlus -.-> PenTest["CompTIA PenTest+ /<br/>CEH (offensive)"]
    CySA --> Adv["Advanced defense<br/>CASP+ / SecurityX"]
    CySA -.->|"detection &<br/>response role"| SOC["SOC analyst /<br/>threat hunter /<br/>IR handler"]
    CySA -.->|"protect privileged<br/>access it monitors"| PAM["PAM / identity security<br/>(specialism)"]

How it relates to the other study hubs in this repository:

  • Relative to Security+ (before CySA+): Security+ is the breadth baseline — it surveys threats, architecture, operations, and governance. CySA+ goes deeper on the operations/analyst side: where Security+ Domain 4 (Security Operations) introduces monitoring and incident response, CySA+ makes the whole exam about analyzing indicators, hunting threats, and running response. Do Security+ first.
  • Relative to this repo's CEH hub (offense): the CEH (Certified Ethical Hacker) hub teaches the attacker's techniques. CySA+ is the other side of the same coin — it teaches the analyst to detect and respond to those same techniques. Reading the CEH module on a technique (e.g. introduction to ethical hacking) tells you what an analyst is hunting for. CySA+ never weaponizes; it defends.
  • Relative to Privileged Access Management (PAM): PAM products control and record privileged access; CySA+ is the analyst who monitors and investigates that access — privileged-account misuse is a top thing a SOC hunts for (see the PAM threat landscape). The attack-to-defense matrix maps attacker techniques to the controls an analyst relies on.
  • Shared fundamentals: the cross-cutting protocols reference (TLS, Kerberos, LDAP, SAML, OIDC/OAuth2, RADIUS, SSH) and the repo reference glossary and acronyms reinforce concepts that appear across CySA+, Security+, CEH, and PAM.

DoD 8140 relevance (verify on DoD / CompTIA)

Like Security+, CySA+ is referenced as a United States Department of Defense (DoD) baseline credential for several cyber work roles. CompTIA states that CySA+ aligns with multiple DoD Directive 8140 roles (particularly analyst and incident-response roles). DoD Directive 8140 is the current cyber-workforce qualification framework that succeeded the older DoD 8570 information-assurance baseline. This alignment is a reason CySA+ appears in US government and defence-contractor job requirements.

  • Approved-certification lists and role mappings are revised over time — confirm the current CySA+ status and role mappings on the DoD cyber-workforce site: https://public.cyber.mil/ (verify on DoD / CompTIA — specifics change).

Where to go next

Sources