CMMC CCP: how to become a CMMC Certified Professional
Published 2026-10-29, 12 min read
A CMMC Certified Professional (CCP) is a person, not a company: someone trained on CMMC and the assessment process who advises defense contractors and may sit on a Level 2 certification assessment team under a certified assessor. ISACA, the program's certification body, runs the exam. The CCP is also the first step to becoming a CMMC assessor.
- 170questions, 210 minutes
- Multiple choice, one best answer of four, in English, at a PSI centre or proctored remotely. ISACA guide
- 450of 800 to pass
- A scaled score from 200 to 800. A wrong answer costs nothing, so answer every question. ISACA guide
- 3years per certificate
- Then recertify with the CAICO, with yearly continuing education in between. § 170.13(b)(1)
- 2,350CCP listings
- On the Cyber AB Marketplace on 2026-10-29. A listing, not a head count: one person can hold several. Marketplace
A CCP certificate belongs to the person who earned it. It does not certify the company they work for, and nothing in 32 CFR Part 170 asks a shop to employ one.
- In force today
- DFARS 252.204-7012 still applies: NIST SP 800-171 Rev 2 on systems that hold covered defense information, cyber incidents reported to DoD within 72 hours, and FedRAMP Moderate or equivalent for any cloud that holds it. DFARS 252.204-7012(b)(2), (c)
- Suspended
- Phase 2, due in November 2026, is suspended for every contractor, whatever its size: contracts are not adding the third-party Level 2 (C3PAO) or Level 3 (DIBCAC) requirements. DoW CIO memo of 2026-07-13, applied by Class Deviation 2026-O0025 Rev 3
- Not yet known
- The outcome of the CMMC Reform Task Force review is not confirmed as of 2026-10-23: no report or rule change has been published. Federal Register search, 2026-10-23
What a CMMC Certified Professional is
The CCP is one of the people roles written into the CMMC rule itself, at 32 CFR 170.13. The rule describes someone who has done “rigorous training on CMMC and the assessment process to provide advice, consulting, and recommendations” to the companies being assessed. In practice that is the compliance lead at a managed service provider, the consultant who scopes your enclave, or the person at a C3PAO who is working toward assessor.
One body certifies CCPs, the CMMC Assessor and Instructor Certification Organization (CAICO), and the rule allows only one at a time. The Cyber AB, the program's accreditation body, now names ISACA as that CAICO. So the exam, the application and the renewals run through ISACA, while the Cyber AB keeps the Marketplace where certified people are listed. The consulting badges the Cyber AB grants on its own, the RP and RPO, are a different thing, explained in what a CMMC RPO is.
| Certificate | What it adds | What the holder does |
|---|---|---|
| CCPCMMC Certified Professional | Training from an approved provider, the CCP exam and a Tier 3 background investigation. No experience minimum. § 170.13 | Advises clients; may join a Level 2 assessment team under a CCA. |
| CCACMMC Certified Assessor | An active CCP, 3 years in cybersecurity, 1 in assessment or audit, a DoD 8140 Work Role 612 qualification, and a second exam (150 questions). § 170.11(b)(6) | Conducts Level 2 certification assessments for a C3PAO and makes the final determinations. |
| Lead CCALead CMMC Certified Assessor | 5 years in cybersecurity, 5 in management, 3 in assessment or audit, and an Advanced-level 612 qualification. § 170.11(b)(10) | Leads the assessment team. |
| CCICMMC Certified Instructor | Instructor training and testing on top of a CCP or CCA certification. § 170.12 | Teaches CCP candidates (and CCA candidates, if a CCA). |
Every rung above the first needs the one below it. The Cyber AB puts it plainly: you must become a certified CCP before pursuing CCA training. If your goal is to assess shops for a C3PAO, the CCP is not optional: it is the first exam of two, and the CCA adds the experience and the 8140 qualification on top. How a C3PAO builds its teams from these people is in what is a C3PAO.
What a CCP can and cannot do for your shop
Most small contractors meet a CCP from the other side of the table: the MSP or consultant who quotes your readiness work lists one on the proposal. The certificate tells you that person has been trained and tested on the assessment process. It does not tell you they can assess you, and the rule draws that line clearly.
- Give your shop advice, consulting and recommendations: scoping, gap analysis, evidence, getting ready. § 170.13(a)
- Sit on a C3PAO's Level 2 certification assessment team, with a CCA overseeing the work. § 170.9(b)(12)
- Go on to become a CCA, the person who can assess you, once the experience is there. § 170.13(a)
- Make a final determination on any requirement. On an assessment team, the CCA makes all of them. § 170.13(a)
- Take part in your Level 2 certification assessment within 3 years of preparing you for it. § 170.8(b)(17)(ii)(G)
- Pass on what they learned about you during an assessment to anyone not on that assessment. § 170.13(b)(6)
- Give your company a CMMC status. A status comes only from an assessment, entered in SPRS. § 170.4
That bar follows the person, so it matters even when the firm changes. If the CCP who wrote your system security plan later joins a C3PAO, they cannot be on your assessment team inside those three years. When you hire help, ask for every name on the account and look each one up on the CMMC Marketplace: a CCP appears as a personal listing, and ISACA lists only people who hold an active certificate and have taken the Delta Training. The questions worth asking a consultant before you sign are on our CMMC consultants comparison.
How to become a CMMC CCP: training, exam, Tier 3
The path has a fixed order, and the background investigation comes last, so a candidate can study, train and pass before anyone opens a file on them. These are the steps as ISACA's CCP page sets them out:
- 01Check the background ISACA and the Cyber AB expectThere is no experience minimum for the CCP. The Cyber AB recommends a degree or two years in cyber, IT or assessment work (military counts), CompTIA A+ or the same knowledge, and DoD CUI awareness training.
- 02Take CCP training from an Approved Training ProviderThe course is mandatory. Approved Training Providers (ATPs) are listed on the Cyber AB Marketplace, and the instructor must hold a CCP or CCA certificate. Until ISACA's new curriculum arrives, expected around the first quarter of 2027, ATPs teach the current approved course material, which the exam follows.
- 03Register for the exam with ISACAPay the registration fee in full in your MyISACA account. That opens a six-month eligibility window; you can book a slot from 48 hours after paying, up to 90 days ahead.
- 04Sit the examAt a PSI test centre or as a remotely proctored exam. You see a preliminary pass or fail on screen; the official score follows by email within ten working days.
- 05Apply for certificationAfter a pass, submit the application and the US$200 processing fee, and agree to ISACA's Code of Professional Ethics and CPE policy. ISACA's CCP page allows five years from the pass to apply, but its 2026 candidate guide says one year, so apply soon after you pass.
- 06Clear the Tier 3 background investigationIt starts once you apply: ISACA checks your experience, then the Cyber AB opens the investigation on Standard Form 86. It is not a security clearance. Someone not eligible for Tier 3 needs an equivalent that DoD decides.
- 07Take Delta Training and get listedThe Marketplace lists only holders of an active certificate who have done ISACA's Delta Training, which updates the course material to the current rule. It can be taken after the exam.
CMMC CCP training is the step you plan around. Each ATP sets its own schedule, format and price, so compare a few on the Marketplace and ask which edition of the course material they teach. Before the course, the free reading pays off: the rule itself, and the 110 requirements of CMMC Level 2 that a Level 2 assessment checks.
The CMMC CCP exam: format, domains and scoring
ISACA publishes the format in its exam candidate guide. The CCP exam is one computer-based sitting, scored on the total number of questions you answer correctly whatever their domain, so the 6 domains below tell you where the questions sit, not how you are graded.
- Questions
- 170 multiple choiceFour options each, one best answer. Some are unscored pretest items.
- Time
- 3.5 hours210 minutes in one sitting, in English.
- Where
- PSI centre or remoteClosed book: no notes, reference or study material in the room.
- Pass mark
- 450 of 800A scaled score from 200 to 800; a wrong answer costs nothing.
The heaviest domain by far is the CMMC model and how a requirement is judged as implemented. Together with the assessment process and scoping, it is 75% of the exam: this is an exam about reading evidence against requirements, not about configuring firewalls.
- CMMC Ecosystem5%
- CMMC-AB Code of Professional Conduct (Ethics)5%
- CMMC Governance and Source Documents15%
- CMMC Model Construct and Implementation Evaluation35%
- CMMC Assessment Process (CAP)25%
- Scoping15%
Bars are drawn against the largest domain. Domain results on your score report are for information only.
Scoping carries its own 15%, and it is the domain a shop's own staff can put to work at once: which assets hold CUI, which only protect it, and which sit outside. Our CMMC scoping worksheet walks the same asset categories on your real systems.
If you do not pass
ISACA allows four attempts in a rolling 12 months, each with the full registration fee, and spaces them out:
- Attempt 1Any time in your six-month eligibility
- Attempt 230 days after attempt 1
- Attempt 390 days after attempt 2
- Attempt 490 days after attempt 3
A failed result can be rescored by PSI if you ask in writing within 30 days. Once you pass, you cannot sit the same exam again while the application period runs, or while you hold the certificate.
What a CCP costs, and how you keep it
A candidate pays three ways: the training provider, ISACA, and the days away from work. Only ISACA's fees are published in one place, and ISACA changed them when it took over as the certification body. If you find an older fee table on the Cyber AB's site, note that the Cyber AB's own pages now send CCP questions to ISACA.
| Fee | Amount | When |
|---|---|---|
| Exam registration, ISACA member | US$575 | Per attempt, nonrefundable |
| Exam registration, non-member | US$760 | Per attempt, nonrefundable |
| Certification application | US$200 | Once, after you pass |
| Rescore request | US$75 | Within 30 days of a failed result |
Training is priced by each Approved Training Provider and is not included. Annual maintenance fees are billed by ISACA on your yearly invoice.
ISACA's own example of the whole cycle: someone holding both the CCP and the CCA spent $3,175 over three years under the old pricing, and pays $2,280 through ISACA, or $2,105 as an ISACA member. The exam costs more than it did; the yearly renewals cost less.
Keeping the certificate
- A certificate is valid for 3 years from the date of issue. § 170.13(b)(1)
- At least 20 hours of continuing education (CPE) a year and 120 over the three-year cycle, of which at least 90 match the exam's content and 2 a year cover the CMMC rules. The other 30 may be general professional development. ISACA CPE policy
- Retraining and recertification when DoD changes the program significantly, as DoD or the CAICO decides. § 170.10(b)(16)
- The Cyber AB's conduct rules: no misstated credentials, client data kept confidential, and convictions for fraud and similar offences reported within 30 days. § 170.8(b)(17)
Should someone at your shop get a CCP?
The answer depends on who is asking. A 30-person machine shop and the MSP that runs its email ask the question for different reasons, and the answer is not the same. Pick yours:
A CCP for you: Useful, not required
- The course and exam teach how an assessor reads your evidence: the model, the assessment process and scoping carry most of the exam. ISACA guide § 1.2
- It costs a training course, ISACA's exam and application fees, and a Tier 3 background investigation before the certificate is issued. § 170.13(b)(3)
- It does not certify your company and it does not replace your own assessment or your affirmation. § 170.4
For most small contractors the work that moves an assessment is not a certificate on the wall. It is an accurate system security plan, a scope you can defend and a score you can stand behind. The route from there to a status in SPRS is in how to get CMMC certified.
Questions about the CMMC CCP
What does CCP stand for in CMMC?
CMMC Certified Professional, the name 32 CFR 170.13 uses. You will also see “Certified CMMC Professional”, including on the Cyber AB's own pages; it is the same certificate, issued by the CAICO (today ISACA).
Is a CCP a security clearance?
No. A CCP needs a favorable Tier 3 background investigation, opened on the SF 86, and the rule says in so many words that it “will not result in a security clearance”. It only establishes eligibility to take part in CMMC work.
Do I need IT experience to take the CCP exam?
ISACA sets no experience requirement for the CCP. The Cyber AB recommends a degree or two years in cyber, IT or assessment, CompTIA A+ or the same knowledge, and DoD CUI awareness training first. Experience becomes a hard requirement only at the next step, the CCA.
Can I take the CCP exam online?
Yes. ISACA offers it at PSI test centres and as a remotely proctored exam: 170 questions in 3.5 hours, in English, closed book. The training before it is booked with an Approved Training Provider, each with its own format.
Can a CCP assess my company?
Not on their own. A CCP may sit on a C3PAO's Level 2 certification assessment team, but a CCA oversees the work and makes all final determinations. How the team is built is in what is a C3PAO.
Is a CCP the same as a Registered Practitioner?
No. The CCP is written into 32 CFR Part 170 and certified by the CAICO; the RP is the Cyber AB's own consulting badge, outside the rule. A consultant can hold both. The difference is laid out in what is a CMMC RPO.
How long does a CCP certification last?
Three years from the date of issue, then recertification with the CAICO. In between, ISACA asks for continuing education every year and an annual maintenance fee.