- Identity Check: Which CCP This Sheet Covers
- Exam Snapshot: Format, Fees, Delivery
- Domain Weights at a Glance
- Domains 1 and 2: Ecosystem and Conduct
- Domain 3: Governance, FCI, CUI, Source Documents
- Domain 4: Model Construct and Evaluation
- Domain 5: The CMMC Assessment Process
- Domain 6: Scoping
- Facts You Must Verify Yourself
- Study Order Built Around the Weights
- FAQ
- The outline publishes 170 questions across six weighted domains and 15 nested objectives.
- Domain 4 (Model Construct and Implementation Evaluation) is the heaviest at 35%; the Assessment Process follows at 25%.
- Listed fees are US$575 for members and US$760 for non-members; confirm on the official page before paying.
- Pass threshold, duration, prerequisites and renewal rules are not on this sheet; verify them in the current candidate guide.
Identity Check: Which CCP This Sheet Covers
This cheat sheet covers one credential only: the CMMC Certified Professional (CCP). ISACA's current content outline titles it "Certified CMMC Professional," and ISACA describes itself as serving as the official CAICO (CMMC Assessment and Certification Ecosystem organization) for it. The acronym "CCP" is shared by several unrelated credentials, so make sure every fee, date and domain you study comes from the CMMC-specific materials. The official sources are the exam content outline and the credential page, which links to the candidate guide.
If you are still orienting yourself, these background pieces cover the basics: What Is CCP Certification?, What Does CCP Stand For? and CCP Meaning.
Exam Snapshot: Format, Fees, Delivery
| Item | What the Sources Say |
|---|---|
| Credential name | CMMC Certified Professional (outline title: "Certified CMMC Professional") |
| Certifying body | ISACA, serving as the official CAICO |
| Question count | 170 questions per the published outline |
| Structure | Six weighted domains, 15 nested objectives |
| Listed fees | US$575 (member), US$760 (non-member) |
| Delivery | Computer-based testing at authorized PSI test centers, or remote proctoring |
| Scheduling | May be available about 48 hours after payment |
| Duration, pass threshold, prerequisites, validity/renewal | Verify in the current candidate guide |
| Pass rate | Not publicly disclosed |
Fee mechanics matter more than most candidates expect. The member/non-member gap is US$185, so check whether membership changes your total outlay before you register. For a fuller breakdown of what you will spend, see the CCP certification cost guide. For scheduling windows and deadlines, see CCP exam dates.
Because the pass rate is not publicly disclosed, any specific figure you see quoted online should be treated skeptically. The CCP pass rate article explains what can and cannot be said from available information, and CCP passing score covers how to confirm the threshold in the candidate guide.
Domain Weights at a Glance
| Domain | Name | Weight |
|---|---|---|
| 1 | CMMC Ecosystem | 5% |
| 2 | CMMC-AB Code of Professional Conduct (Ethics) | 5% |
| 3 | CMMC Governance and Source Documents | 15% |
| 4 | CMMC Model Construct and Implementation Evaluation | 35% |
| 5 | CMMC Assessment Process (CAP) | 25% |
| 6 | Scoping | 15% |
Two domains, 4 and 5, account for 60% of the exam. Domains 3 and 6 add another 30%. The remaining 10% is split evenly between the ecosystem and ethics domains. The full walkthrough of each area is in the CCP exam domains guide; this section of the cheat sheet compresses it.
Domains 1 and 2: Ecosystem and Conduct (5% Each)
Domain 1: CMMC Ecosystem (5%)
The outline objective is to compare the roles, responsibilities and requirements of the ecosystem's authorities.
- Know who the authorities are and what each one is responsible for.
- Practice distinguishing similar-sounding roles; questions in this area reward clean comparisons.
- Be able to say which party does what, not just name the parties.
Domain 2: CMMC-AB Code of Professional Conduct (5%)
The outline objective is to apply the Code of Professional Conduct principles along with ISO/IEC and DoW requirements.
- Expect application-style items: you are given a situation and asked what conduct the Code requires.
- Know the principles well enough to apply them, not merely recite them.
- Pay attention to the ISO/IEC and DoW requirements referenced alongside the Code.
These two domains are small, which makes them the cheapest points on the exam. A short, focused pass is usually enough, but do not skip them: ethics scenarios can be worded so that two answers look defensible, and only the Code's actual principles separate them.
Domain 3: Governance, FCI, CUI, Source Documents (15%)
Domain 3: CMMC Governance and Source Documents
This domain covers what the data is, who holds authority over it, and which documents govern it.
- FCI and CUI on nonfederal unclassified networks: understand both categories and where each applies.
- Roles and authority: determine the FCI/CUI roles and who has authority over designation and handling.
- Source and supplementary documents: understand what each is for and how it feeds into assessment.
The recurring trap here is treating FCI and CUI as interchangeable. They are not, and the outline lists understanding both, plus determining roles and authority, as separate skills. When a scenario describes information, decide first what category it is, then who is responsible for it, and only then which document supports the answer.
Domain 3 also sets up Domains 4 and 6. Candidates who understand the source documents find the practice-evaluation questions in Domain 4 far less abstract.
Domain 4: Model Construct and Implementation Evaluation (35%)
This is the biggest domain and the one most candidates underestimate. The outline asks you to do three distinct things:
Domain 4 Objectives
- Apply source documents to evaluate and review CMMC practices, at minimum the Level 1 practices.
- Apply assessment criteria and methodology to judge whether a practice is met.
- Analyze evidence: where it is located, how it is collected, its quality, and how it is used.
Notice the verbs: apply, apply, analyze. This is not a memorization domain. Expect scenario items where you are handed a practice, some described evidence and a method, and must decide what the evidence does or does not demonstrate.
Since this domain carries 35% of the exam, difficulty perception often hinges on it. If you are weighing how demanding the exam is overall, how hard the CCP exam is discusses where candidates tend to struggle, and the CCP study guide shows how to build practice around it.
Domain 5: The CMMC Assessment Process (25%)
The CAP domain is organized around four phases, and the outline frames each in terms of the CCP's role:
| Phase | Name | What the Outline Emphasizes |
|---|---|---|
| 1 | Plan and Prepare | The CCP's role in preparing the assessment |
| 2 | Conduct | The CCP's role while the assessment is carried out |
| 3 | Report | The CCP's role in reporting results |
| 4 | Outstanding POA&M evaluation | Evaluating outstanding POA&M items |
The outline also calls for scenario-based understanding of the Level 2 assessment phases and steps. That means you should be able to sequence what happens, not just name the phases. A good drill: take a hypothetical Level 2 assessment and narrate it from first planning activity to final POA&M review, naming what the CCP does at each stage and what it hands off to others.
Key Takeaway
Anchor every CAP fact to a role. The outline repeatedly asks what the CCP does in each phase, so "who does this and when" is a more productive study question than "what is this phase called."
Domain 6: Scoping (15%)
Domain 6: Scoping
The outline names two skills: high-level CAP scoping, and analyzing the environment to scope FCI assets.
- Understand scoping as it feeds the assessment process, at a high level.
- Practice analyzing a described environment to decide which assets fall into FCI scope.
- Connect scoping back to Domain 3: you cannot scope FCI assets without knowing what FCI is.
Scoping questions usually present a small environment and ask what is in or out of scope. Work from the data inward: identify where FCI exists, then identify the assets that handle it. The same discipline carries into real engagements, which is why scoping knowledge shows up in CCP-related job descriptions alongside assessment support work.
Facts You Must Verify Yourself
A cheat sheet is only useful if it is honest about its edges. The following are not established on this page and must be confirmed in the current candidate guide before you rely on them:
- Exam duration (the number of questions is published; the time allowed should be checked).
- Pass threshold and how scoring is reported.
- Prerequisites and eligibility (see CCP requirements for how to approach this).
- Validity period and renewal rules.
- Current fees and scheduling timing, since pricing pages change.
Study Order Built Around the Weights
One way to sequence preparation is to let the domain weights and dependencies set the order. Domain 3 comes first because Domains 4 and 6 depend on it.
Foundations: Domains 1, 2 and 3
- Compare ecosystem roles and responsibilities.
- Work through the Code of Professional Conduct principles with scenarios.
- Separate FCI from CUI and map roles and authority.
Core: Domain 4
- Evaluate Level 1 practices against source documents.
- Drill evidence location, collection, quality and use.
Process and Scope: Domains 5 and 6
- Narrate a Level 2 assessment through all four phases.
- Practice scoping FCI assets from described environments.
Finish with mixed practice so the domains stop feeling like separate subjects. The CCP study guide expands this into a fuller plan, and if you are deciding whether the investment makes sense, see whether the CCP is worth it and the CCP salary guide. When you are ready to test yourself, try the CCP practice tests.
FAQ
Domain 4, Model Construct and Implementation Evaluation, at 35%. Combined with the CMMC Assessment Process at 25%, these two domains make up 60% of the exam.
The published outline lists 170 questions across six weighted domains and 15 nested objectives. Confirm duration and any other format details in the current candidate guide.
The current credential page lists US$575 for members and US$760 for non-members. Verify on the official ISACA page before registering, since fees can change.
Per the current page, the exam is computer-based and is offered at authorized PSI test centers or through remote proctoring. Scheduling may be available about 48 hours after payment.
It is not publicly disclosed, so treat any specific figure you find with caution. The pass threshold itself should be confirmed in the current candidate guide.