Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
The CCP is the entry credential of the DoD's CMMC program, and this guide covers it as it stands in October 2026: the six domains, the 170-question exam, the Approved Training Provider course and Tier 3 background check, the move to ISACA as the credentialing body, where the CCP sits in the 32 CFR Part 170 rule, and how it compares to the CCA and CISA. Use it if you are weighing the CCP or trying to work out what it actually tests.
The CCP is the entry credential of the Cybersecurity Maturity Model Certification (CMMC) program, the Department of Defense's system for checking that defense contractors protect Federal Contract Information and Controlled Unclassified Information. You need it before you can become a CMMC Certified Assessor.
ISACA now runs the credential. On December 17, 2025, ISACA was authorized as the CMMC Assessor and Instructor Certification Organization (CAICO), the one body the rule allows to train, test and certify CCPs, CCAs and instructors. The Cyber AB held the CAICO role before and stays on as the program's accreditation body. Full transition of services was set for April 1, 2026, so guides that send you to The Cyber AB to register, or quote its old fees, are out of date. You will also see the name written two ways. The rule and most of ISACA's pages say CMMC Certified Professional, while ISACA's own exam outline and plenty of course pages say Certified CMMC Professional. Both names mean the same credential.
The rule itself gives the CCP a specific place. Subpart C of 32 CFR Part 170 lists the ecosystem in order: the accreditation body (§170.8), the CMMC Third-Party Assessment Organizations (C3PAOs) that perform Level 2 certification assessments (§170.9), the CAICO (§170.10), CCAs (§170.11), instructors (§170.12), and finally the CCP at §170.13. There a CCP advises organizations seeking assessment, can join Level 2 certification assessments with CCA oversight while the CCA makes every final determination, and is eligible to become a CCA.
Expect questions about how the program runs, from roles and documents to evidence and scope, rather than about any product or tool. ISACA states the CCP is ANAB-accredited under ISO/IEC 17024, the certificate is valid for three years from issue, and there is no experience requirement. ISACA does not claim a DoD 8140 mapping for it. The CCP is issued and maintained by ISACA, whose pages now use the Department of War name for DoD.
The authorities in the program and what each one is responsible for. 5% of the exam.
Ethics, conflicts of interest and confidentiality. Also 5% of the exam.
FCI, CUI, and the documents the requirements come from. 15% of the exam.
Judging practices against evidence. The heaviest domain at 35%.
The CCP's role across all four assessment phases. 25% of the exam.
Drawing the assessment boundary around FCI assets. 15% of the exam.
Phase 2 of the CMMC rollout begins November 10, 2026, when DoD intends to start requiring third-party Level 2 certification as a condition of award on applicable contracts. Four things set the CCP apart.
Federal regulation defines the CCP. 32 CFR §170.13 says what a CCP does, which background check applies and how long the certificate lasts, and §170.10 says only the CAICO can train, test and certify CCPs. If you work in the defense industrial base, it is a credential written into the same rule your contracts point to.
ISACA's 2026 candidate guide states that the CCP has no experience requirement. You need the Approved Training Provider course, a passing score and the Tier 3 check. The Cyber AB still recommends an IT or cyber degree or two or more years of related experience, plus A+ level knowledge, so the bar is low but not zero.
No route to the CMMC Certified Assessor skips the CCP. The rule requires every CCA to be a CCP first, with three years of cybersecurity experience, a year of assessment or audit work, and a credential for the Security Control Assessor role. Our DCWF work role map shows which certifications count.
Every CCP needs a favorably adjudicated Tier 3 background investigation from DoD, started on the SF-86. The rule is explicit that it does not result in a security clearance and is not for government employment. ISACA hands your details to The Cyber AB, which runs point on the investigation, once you have passed the exam and applied. In August 2026 The Cyber AB told DoD these investigations take several months, so plan for the wait.
ISACA does not claim a DoD 8140 mapping for the CCP, so check the current qualification matrix before you count on it for a DoD cyber workforce role. The CAICO's own FAQ is on ISACA's CMMC hub.
The credential, the exam, and what it takes to keep the CCP as of October 2026. Every figure below comes from ISACA or the CMMC rule.
The CCP gets you onto the assessment side of CMMC. The next credential in the program is the assessor, and that path runs through a DoD 8140 qualification. These three are the ones to look at.
The CMMC Certified Assessor conducts Level 2 certification assessments for a C3PAO and makes the final calls a CCP cannot. It needs an active CCP, three years of cybersecurity experience, one year of assessment or audit work, its own Approved Training Provider course and a 150-question, four-hour exam.
ISACA names its own audit credential as one of the ways to meet the CCA's Security Control Assessor (612) requirement. CISA looks at controls from the auditor's chair, which is where CMMC assessment work sits. Read what CISA covers.
ISC2's CGRC sits at the Intermediate level for Security Control Assessor (612) in the DoD 8140 matrix, so it can also meet the CCA requirement. It suits people whose CMMC work runs alongside NIST RMF and federal authorization. Read what CGRC covers.
The CCP is the first credential on the CMMC track. It builds on general IT and security literacy and leads to the assessor credentials, with a DoD 8140 qualification needed along the way.
Build the baseline
The entry credential
Two questions to answer before you commit: can you certify, and should you pursue the CCP specifically. Here's a straight answer to both.
You can certify in full.
There is no experience or degree requirement. Complete the CCP course at an Approved Training Provider, pass the exam, pay the US$200 application fee and apply to ISACA. ISACA then passes your details to The Cyber AB so your Tier 3 background investigation can start, and you agree to ISACA's Code of Professional Ethics and CPE policy. Once DoD returns a favorable Tier 3 determination, you hold the full credential.
Ask before you pay.
The rule lets DoD decide on an equivalent to a favorable Tier 3 for people who cannot obtain one, for use in the CMMC program only. It does not spell out who qualifies for that equivalent, and The Cyber AB's requirements grid lists US citizenship for CCAs. If you are not a US citizen, confirm with ISACA how the equivalency applies to you before you pay for training.
The CCP maps to the CMMC ecosystem rather than to DoD 8140 work roles. The first two cards come straight from how 32 CFR §170.13 describes the CCP. The other four are audiences ISACA names on its own CCP page.
Works on a C3PAO team during Level 2 certification assessments. Under 32 CFR 170.13 a CCP takes part with CCA oversight, and the CCA makes every final determination. ISACA's FAQ limits the CCP's part on that team to verifying Level 1 practices.
Gives advice, consulting and recommendations to organizations preparing for assessment, which is how the rule itself describes the CCP role. ISACA lists gap analysis, evidence collection and audit preparation as the tasks. The conduct code then bars you from assessing that client for three years.
Runs the CMMC effort inside a defense contractor: scoping the environment, tracking the NIST SP 800-171 work, and getting ready for the assessment. ISACA names GRC and compliance leads driving CMMC programs as a core CCP audience.
Owns the systems that handle FCI or CUI at a defense industrial base company and needs to know what an assessor will ask for. Another of the audiences ISACA lists for the CCP.
The CCP is the required first step toward the CCA. Add three years of cybersecurity experience, a year of assessment or audit work and a qualifying DoD 8140 credential, then pass the CCA course and exam.
The CCP has no experience requirement, so someone early in a compliance career can earn it. ISACA names early-career professionals entering defense industrial base cyber compliance among the people the CCP is built for.
The CCP and CCA are two steps on the same CMMC ladder, and CISA is the ISACA audit credential that can meet the CCA's DoD 8140 requirement. Here's how they line up.
| CCP | CCA | CISA | |
|---|---|---|---|
| Issuer | ISACA (as CAICO) | ISACA (as CAICO) | ISACA |
| Focus | CMMC readiness and assessment support | CMMC Level 2 certification assessments | IS audit and assurance |
| Domains | 6 | 4 | 5 |
| Exam Format | 170 items, 3.5 hrs | 150 items, 4 hrs | 150 items, 4 hrs |
| Experience | None required | Active CCP, 3 yrs cyber, 1 yr assessment or audit | 5 yrs IS audit, control, or security |
| Mandatory Training | ATP course | ATP course | None |
| Tier 3 Check | Required | Required | Not required |
| Passing Score | 450 / 800 | 450 / 800 | 450 / 800 |
| Exam Cost | $575 member / $760 non-member | $575 member / $760 non-member | $575 member / $760 non-member |
| Renewal | 120 CPEs over 3 years | 120 CPEs over 3 years | 120 CPEs over 3 years |
| DoD 8140 | Not claimed | Requires a 612 credential | Yes (Advanced) |
| Best For | DIB compliance staff and consultants | C3PAO assessors | IT auditors and assurance leads |
Exam fees depend on ISACA membership status. Annual maintenance fees differ too: US$45 member and US$85 non-member for the CCP, US$90 and US$170 for the CCA. Read the full CISA guide for the detail behind that column.
Certification Matchups puts the published facts, strengths and weak spots of two certifications side by side.
Our CMMC Certified Professional boot camp runs four days, Tuesday through Friday, live online or on-site for teams. It is delivered with ecfirst, an Approved Training Provider and C3PAO, and taught by working CMMC assessors. You cover all six CCP domains with labs each day and a full-length practice exam, and you get the CCP training program materials, a CMMC quick reference card and a glossary. The 170-question exam is scheduled separately through ISACA.
The CMMC program itself, the DoD 8140 side of the assessor path, ISACA's exam rules, and what renewal costs you.
The three CMMC levels, the four-phase rollout from November 2025 to November 2028, and what an organization has to do before its assessment. The program background a CCP candidate walks in with.
How DoD 8140 workforce rules and CMMC organizational requirements differ, and why contractors end up dealing with both at once.
The work role map, including Security Control Assessor (612), the role a CCA's qualifying credential has to line up with.
ISACA delivers through PSI, at a test center or remotely, and its remote exams add a mirror check after the room scan. Read it before you book the CCP.
ISACA's 20-hour annual floor and 120-hour cycle, the same structure ISACA now applies to the CCP and CCA.
CGRC counts toward the Security Control Assessor role the CCA asks for, and its exam outline names CMMC right next to FISMA and FIPS.
Where defense compliance work fits in the wider governance, risk and compliance field, and which credentials line up with which GRC jobs.
ISACA's CCP Exam Content Outline splits the exam into six domains, from the ecosystem and its conduct code through the assessment process and scoping, each with its own weight. Click any domain for what it covers.
Who does what in the program, and on whose authority. The CMMC Program Management Office under the DoD CIO, DCMA's DIBCAC assessors, The Cyber AB as accreditation body, the CAICO, C3PAOs, Approved Training Providers and the organizations seeking certification, plus the separate roles of CCPs, CCAs and instructors.
The guiding principles and practices of the Code of Professional Conduct, and the ISO/IEC and DoD requirements behind them. Expect conflict of interest, confidentiality and honest representation of your credentials. Learn the three-year rule in particular. You cannot take part in the Level 2 certification assessment of an organization you consulted for within the previous three years.
What Federal Contract Information and Controlled Unclassified Information are, how each is handled on nonfederal unclassified networks, and who holds which responsibility for them. Also the source and supplementary documents the program rests on, such as FAR 52.204-21, NIST SP 800-171 and the CMMC rule itself.
The heaviest domain by a wide margin. Given a scenario, use the CMMC source documents to judge whether a practice is actually implemented, apply the assessment criteria and methodology, and decide whether the evidence is adequate and sufficient. ISACA's outline says every candidate is evaluated on at least the Level 1 practices.
The CCP's part in each of the four assessment phases: planning and preparing, conducting the assessment as a team member, reporting results, and evaluating outstanding plan of action and milestones items. Scenario questions ask which phase and step apply on a Level 2 assessment.
High-level scoping as the CMMC Assessment Process describes it, then the scenario work: looking at an organization's environment and drawing an appropriate scope around its FCI assets.
Domains and weights reflect ISACA's CCP Exam Content Outline as published in October 2026. ISACA expects an updated CMMC curriculum in or around the first quarter of 2027.
The questions candidates ask most often when researching the CMMC Certified Professional certification.
The CMMC Certified Professional (CCP), also written Certified CMMC Professional, is the entry credential of the Department of Defense's Cybersecurity Maturity Model Certification program. It shows you understand the CMMC ecosystem, its source documents, the assessment process and scoping well enough to help organizations prepare for assessment or to serve on a Level 2 assessment team. It is also the required first step toward the CMMC Certified Assessor (CCA).
ISACA. On December 17, 2025, ISACA was authorized as the CMMC Assessor and Instructor Certification Organization (CAICO), the one body that trains, tests and certifies CCPs, CCAs and instructors, with full transition of services by April 1, 2026. The Cyber AB held that role before and remains the CMMC accreditation body. Exam registration, certification applications and renewals now run through ISACA.
The CCP fits people whose work touches CMMC compliance: IT and security managers at defense contractors, compliance leads running a CMMC program, consultants who prepare organizations for assessment, and anyone planning to become a CMMC assessor. It is a poor fit if you have no connection to defense contracting, or if what you need is a DoD 8140 qualification, since ISACA claims no 8140 mapping for the CCP.
As of October 2026, the CCP exam costs US$575 for ISACA members and US$760 for non-members. After you pass, ISACA charges a one-time US$200 application processing fee, and the annual maintenance fee is US$45 for members and US$85 for non-members. Training from an Approved Training Provider is a separate cost, and the exam fee is nonrefundable.
The CCP exam has 170 multiple-choice questions, each with four options and one best answer, and you get 3.5 hours (210 minutes). It is offered in English at PSI test centers or by remote proctoring. ISACA reports scores on a scale of 200 to 800, and you need 450 to pass. You have six months from registration to sit the exam.
No. ISACA's 2026 exam candidate guide states that the CCP has no experience requirement. What you do need is the CCP course from an Approved Training Provider. The Cyber AB recommends, but does not require, a degree in a cyber or IT field or two or more years of related experience or education, CompTIA A+ level knowledge, and DoD CUI awareness training.
You do not need a security clearance, but you do need a favorably adjudicated Tier 3 background investigation from DoD. Under 32 CFR 170.13 it is started on the SF-86 and does not result in a security clearance. ISACA passes your details to The Cyber AB, which runs point on the investigation, after you pass the exam and apply. The rule names no citizenship test but lets DoD decide on an equivalent for people not eligible for a Tier 3, so non-US citizens should confirm their path with ISACA first.
The six CCP domains are CMMC Ecosystem (5 percent), CMMC-AB Code of Professional Conduct (Ethics) (5 percent), CMMC Governance and Source Documents (15 percent), CMMC Model Construct and Implementation Evaluation (35 percent), CMMC Assessment Process (25 percent) and Scoping (15 percent). Model Construct and Implementation Evaluation carries the most weight, more than a third of the exam.
A CCP certificate is valid for three years from the date it is issued. ISACA requires at least 20 CPE hours every year and 120 over the three-year period. At least 90 of the 120 must relate to the CCP itself, two of those must cover CMMC rules, and the other 30 can be general professional development. You also pay an annual maintenance fee of US$45 as an ISACA member or US$85 as a non-member.
ISACA does not claim a DoD 8140 mapping for the CCP, so check the current qualification matrix before you count on it for a DoD cyber workforce role. The link runs the other way. To become a CCA, you need a separate credential aligned to at least the Intermediate level of the Security Control Assessor (612) work role in DoD Manual 8140.03. See the full DoD 8140 work role paths.
The CCP is the entry credential. A CCP can advise organizations and take part in Level 2 certification assessments under CCA oversight, but cannot make final determinations. The CCA conducts Level 2 certification assessments for a C3PAO and makes those calls. It requires an active CCP, three years of cybersecurity experience, one year of assessment or audit experience and a DoD 8140 credential for work role 612, plus its own training and a 150-question, four-hour exam.
The current outline is ISACA's six-domain CCP Exam Content Outline, and ISACA says the exam is aligned to the approved CMMC training materials that Approved Training Providers deliver today. ISACA told the CMMC community on March 25, 2026 that an updated curriculum is expected in or around the first quarter of 2027. People certified under the current materials also need Delta Training, which covers recent rule and process changes and is required for a Cyber AB Marketplace listing.
Weighing the CCP, planning around the Tier 3 wait, or training a compliance team before Phase 2? Tell us where you are and we'll help you map out the right path.