- What the CCP Credential Actually Is
- Exam Format, Fees, and Scheduling
- The Six Domains and Where the Points Are
- How CCP Questions Are Written
- Domain 4: Where Most Candidates Win or Lose
- Mastering the CMMC Assessment Process
- Scoping, FCI, and CUI
- Who Hires CCP Holders
- Sequencing Your Prep by Domain
- What to Verify Before You Pay
- Frequently Asked Questions
- The CMMC Certified Professional (CCP) outline publishes 170 questions across six weighted domains and 15 nested objectives.
- Domain 4 (Model Construct and Implementation Evaluation) carries 35%, and the CMMC Assessment Process carries another 25%.
- Current ISACA fees are US$575 for members and US$760 for non-members, delivered by computer at PSI centers or remote proctoring.
- Duration, passing threshold, prerequisites, and renewal rules must be confirmed in the current candidate guide before you register.
What the CCP Credential Actually Is
The CMMC Certified Professional credential is built for people who support Cybersecurity Maturity Model Certification assessments of defense contractors. ISACA's current outline titles it "Certified CMMC Professional," and ISACA describes itself as serving as the official CMMC Assessor and Instructor Certification Organization (CAICO). If you have searched the acronym and landed on unrelated credentials, note that this article covers only the CMMC credential. For plain-language orientation, see our explainers on what CCP certification is and what CCP stands for.
The CCP is a practitioner-level credential. It tests whether you can participate competently in an assessment team: understanding the ecosystem of authorities, following professional conduct rules, reading the governing documents, evaluating practices against evidence, and supporting the assessment process from planning through reporting. It is not a general cybersecurity exam, and it is not the lead-assessor credential. Do not confuse it with the Certified CMMC Assessor (CCA) track; the CCP outline is its own document with its own objectives.
Exam Format, Fees, and Scheduling
The published outline lists 170 questions. The exam is computer-based and can be taken at authorized PSI test centers or through remote proctoring. ISACA's current page lists US$575 for members and US$760 for non-members, and scheduling may become available about 48 hours after payment. For a full cost picture beyond the exam fee, including study materials, read our CCP certification cost breakdown.
| Item | What is published | What to confirm yourself |
|---|---|---|
| Question count | 170 questions in the content outline | Whether all items are scored |
| Fee | US$575 member / US$760 non-member | Current pricing at checkout |
| Delivery | Computer-based at PSI centers or remote proctoring | Remote-proctoring system and room requirements |
| Scheduling | May be available 48 hours after payment | Testing windows and rescheduling policy |
| Duration | Not asserted here | Exam length in the candidate guide |
| Passing threshold | Not asserted here | Scoring method in the candidate guide |
| Prerequisites and renewal | Not asserted here | Eligibility, validity, and renewal rules |
The right-hand column matters. Pass rates are not publicly disclosed, so any specific percentage you see quoted should be treated with suspicion; our CCP pass rate analysis explains what can and cannot be said responsibly. For eligibility details, start with the candidate guide and then compare against our CCP requirements overview, and check the CCP passing score article and exam dates guide for scheduling context.
The Six Domains and Where the Points Are
The content outline weights six domains. The distribution tells you where to spend your hours.
| Domain | Name | Weight |
|---|---|---|
| 1 | CMMC Ecosystem | 5% |
| 2 | CMMC-AB Code of Professional Conduct (Ethics) | 5% |
| 3 | CMMC Governance and Source Documents | 15% |
| 4 | CMMC Model Construct and Implementation Evaluation | 35% |
| 5 | CMMC Assessment Process (CAP) | 25% |
| 6 | Scoping | 15% |
Domains 4 and 5 together account for 60% of the exam. A candidate who knows the ecosystem and ethics cold but is shaky on evaluating practices and running the assessment process is preparing for the wrong exam. For a deeper walkthrough of each content area, see our complete guide to all six CCP domains.
Domain 1: CMMC Ecosystem (5%)
The objective is to compare the roles, responsibilities, and requirements of the authorities in the CMMC ecosystem.
- Know who sets requirements, who accredits, who assesses, and who is assessed.
- Expect comparison-style questions: which body is responsible for which function.
Domain 2: Code of Professional Conduct (5%)
You apply the CMMC-AB Code of Professional Conduct principles along with ISO/IEC and Department of War requirements.
- Think conflicts of interest, confidentiality, and handling of sensitive assessment information.
- Questions are typically situational: what should a professional do when a conduct principle is at stake.
Domain 3: Governance and Source Documents (15%)
You must understand Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) in nonfederal unclassified networks, determine FCI/CUI roles and authority, and understand the source and supplementary documents.
- Distinguish FCI from CUI and know who holds authority over each.
- Know which document governs which question, and which are supplementary.
How CCP Questions Are Written
The outline's verbs are a preview of the exam's cognitive demands: "compare," "apply," "understand," "determine," "analyze." Domain 1 asks you to compare. Domain 2 asks you to apply. Domains 4 and 5 ask you to apply and analyze, and Domain 5 explicitly includes scenario-based questions about Level 2 assessment phases and steps. That means you will see questions that describe a situation, such as an organization's environment or a piece of evidence, and ask what the assessor team should do or conclude.
Memorizing definitions will carry you through Domains 1 and 3 but will not carry you through the heavily weighted domains. If you are trying to gauge how demanding this is, our CCP exam difficulty guide unpacks what makes the question style tricky. A CCP practice test that uses scenario-style items is far better preparation than flash cards alone.
Domain 4: Where Most Candidates Win or Lose
At 35%, Domain 4 is the exam's center of gravity. The outline asks you to apply source documents to evaluate and review CMMC practices, at a minimum the Level 1 practices, then apply assessment criteria and methodology, and finally analyze evidence: where it lives, how it is collected, its quality, and how it is used.
Domain 4: Model Construct and Implementation Evaluation
This domain tests whether you can judge an implementation, not just recite a practice.
- Applying source documents: map a practice to the language of the governing documents and decide what "implemented" would look like.
- Assessment criteria and methodology: understand how an assessment objective is evaluated and what supports a determination.
- Evidence analysis: distinguish strong evidence from weak, know where evidence is typically found, and recognize when evidence does not actually support the claim.
A useful drill: for each Level 1 practice, write down in your own words what an assessor would expect to see, where that proof might reside, and what would make it insufficient. This builds the evidence-quality judgment the outline names explicitly. Pair this with the topic list in our CCP cheat sheet for fast review.
Mastering the CMMC Assessment Process
Domain 5, the CMMC Assessment Process (CAP), is 25% of the exam and is organized around four phases, each with a CCP role described in the outline.
- Phase 1, Plan and Prepare: what the CCP contributes before fieldwork begins.
- Phase 2, Conduct: the CCP's role while the assessment is underway.
- Phase 3, Report: how findings are documented and communicated.
- Phase 4, Evaluation of outstanding POA&M items: handling Plan of Action and Milestones items that remain open.
On top of the phase-by-phase roles, the outline calls out scenario-based questions on Level 2 assessment phases and steps. Learn the sequence well enough that, given a scenario mid-assessment, you can say which phase you are in, what has already happened, and what comes next. Sequence errors are the classic way to lose points here.
Key Takeaway
For Domain 5, study the phases as a story with handoffs. Know what artifacts and decisions enter and leave each phase, and be able to place any scenario on that timeline.
Scoping, FCI, and CUI
Domain 6 (15%) is about high-level CAP scoping: analyzing the environment to scope FCI assets. Domain 3 (15%) covers FCI and CUI roles, authority, and the source documents. Together these two domains make up 30% of the exam, and they feed Domain 4, because you cannot evaluate practices without knowing what is in scope.
The recurring skills are:
- Recognizing which assets handle, store, or transmit FCI in a described environment.
- Telling FCI apart from CUI and knowing who has authority to designate each.
- Understanding how a scoping decision changes what must be assessed.
Scoping questions reward careful reading of the scenario. A single sentence about where data flows can change the correct answer, so train yourself to extract the environment details before looking at the options.
Who Hires CCP Holders
Demand for CMMC-credentialed people comes from the ecosystem the exam teaches you about. Organizations that assess, advise, or prepare defense contractors need staff who understand the model and the assessment process. Typical employers include:
- Consulting and advisory firms that help defense suppliers prepare for assessment.
- Assessment organizations that staff assessment teams.
- Managed service and compliance providers supporting contractors that handle FCI or CUI.
- Defense contractors with internal compliance or security governance roles.
Compensation varies widely by employer type, location, and experience, and no single figure should be treated as universal. Our CCP salary guide and CCP jobs overview discuss the landscape qualitatively, and our ROI analysis helps you weigh the fee against your own career path.
Sequencing Your Prep by Domain
The only scheduling advice worth giving is advice that follows the weights. Start with the vocabulary-heavy foundations so the later domains make sense, then spend the bulk of your time where the points are. A sample progression, adjustable to your own calendar:
Ecosystem, Ethics, and Governance
- Domains 1 and 2 are only 5% each, so cover them quickly.
- Spend the remaining time on Domain 3: FCI vs. CUI, roles, authority, and source documents.
Scoping Plus Level 1 Evaluation
- Study Domain 6 now because scoping determines what you evaluate.
- Begin Domain 4 with Level 1 practices and the evidence questions for each.
Assessment Process and Scenarios
- Work Domain 5 phase by phase, including POA&M evaluation.
- Take scenario-based practice items and review every miss against the outline.
For a fuller plan, see our CCP study guide, and consider structured CCP training options if you want instructor-led coverage of the source documents.
What to Verify Before You Pay
Because the outline and the candidate guide are separate documents, do a short verification pass before registering:
- Open the official outline at ISACA's CCP exam content outline page and confirm the domain names and weights match what you studied.
- Download the candidate guide from the ISACA credential page and read the sections on exam length, scoring, eligibility, and renewal.
- Confirm fees at checkout, including the member versus non-member price.
- Decide between a PSI test center and remote proctoring, and check the technical and environmental requirements for the remote option.
- Check scheduling availability after payment, since slots may open about 48 hours later.
Frequently Asked Questions
It covers six domains: the CMMC ecosystem, the Code of Professional Conduct, governance and source documents, model construct and implementation evaluation, the CMMC Assessment Process, and scoping. Domain 4 is the largest at 35%. See the what is CCP explainer for background.
The published content outline lists 170 questions. Confirm the exam length and scoring details in the current ISACA candidate guide, since those specifics are not restated here.
ISACA's current page lists US$575 for members and US$760 for non-members. Always verify at checkout, and budget separately for study materials.
It is computer-based, offered at authorized PSI test centers or through remote proctoring. Scheduling may be available about 48 hours after payment, so plan ahead rather than assuming same-day availability.
No. The pass rate is not publicly disclosed, so treat any specific figure you encounter skeptically and focus on mastering the weighted domains instead.