- The CCP Exam Blueprint at a Glance
- Why the Weights Matter More Than the Order
- Domain 1: CMMC Ecosystem (5%)
- Domain 2: Code of Professional Conduct (5%)
- Domain 3: Governance and Source Documents (15%)
- Domain 4: Model Construct and Implementation Evaluation (35%)
- Domain 5: CMMC Assessment Process (25%)
- Domain 6: Scoping (15%)
- How the Six Domains Connect in Scenario Questions
- Sequencing Your Domain Study
- Exam Logistics Tied to the Outline
- Frequently Asked Questions
- The CCP outline publishes 170 questions across six weighted domains and 15 nested objectives.
- Domain 4 (Model Construct and Implementation Evaluation) is the heaviest at 35%; the CMMC Assessment Process follows at 25%.
- Ecosystem and Code of Professional Conduct are only 5% each, but both are quick, reliable points.
- Scoping is 15% and feeds directly into how you reason through assessment scenarios.
The CCP Exam Blueprint at a Glance
The CMMC Certified Professional (CCP) credential is built around an official content outline published by ISACA, which identifies itself as the CMMC Accreditation Body's official CAICO. You may see the credential named "Certified CMMC Professional" in the current outline, but it is the same CCP credential this site covers. The outline lists 170 questions spread across six weighted domains, with 15 nested objectives underneath them. If you are new to the credential itself, start with What Is CCP Certification? and then return here for the domain-level detail.
One distinction matters before you open any study material: the outline's publication date is not the same thing as the CMMC framework version. The framework (the model, its levels and its practices) evolves through rulemaking and updates to source documents, while the exam outline is a separate artifact with its own revision history. When you read about "2026" in connection with this exam, treat it as the year you are preparing, not as a statement about which model version the questions reflect. Always check the current outline and candidate guide, available through the ISACA credential page and the official exam content outline.
| Domain | Name | Weight |
|---|---|---|
| 1 | CMMC Ecosystem | 5% |
| 2 | CMMC-AB Code of Professional Conduct (Ethics) | 5% |
| 3 | CMMC Governance and Source Documents | 15% |
| 4 | CMMC Model Construct and Implementation Evaluation | 35% |
| 5 | CMMC Assessment Process (CAP) | 25% |
| 6 | Scoping | 15% |
Why the Weights Matter More Than the Order
The domains are numbered in the order ISACA presents them, but the numbering says nothing about how much attention each deserves. Domains 4 and 5 together account for 60% of the exam. Add Domain 6 and Domain 3 and you reach 90%. The two smallest domains, Ecosystem and Code of Professional Conduct, total just 10%.
That distribution has a practical consequence. A candidate who has memorized every ecosystem authority and every ethics principle but is shaky on evaluating practices and running an assessment is exposed on the majority of the exam. Conversely, someone who is strong on Domains 4 and 5 can absorb a few misses in the lighter domains. If you want to see how this plays into overall difficulty, read How Hard Is the CCP Exam? Complete Difficulty Guide 2026.
Domain 1: CMMC Ecosystem (5%)
The first domain asks you to compare the roles, responsibilities and requirements of the authorities that make up the CMMC ecosystem. This is a recognition-and-comparison domain: who does what, who answers to whom, and what each party is required to do. The questions tend to test whether you can distinguish one body or role from another when a scenario describes a situation.
What to master in Domain 1
Know the ecosystem as a map of relationships rather than a list of acronyms.
- The role of the accreditation body versus the other authorities in the ecosystem
- How the Department of War (referenced in the outline as DoW) relates to the program
- How assessors, assessment organizations and the organizations seeking certification relate to one another
- The difference between a body that governs, one that accredits, and one that assesses
A useful drill is to take any scenario sentence ("a contractor engages an assessment organization...") and name the authority responsible for each action in it. If you can narrate who is accountable at each step, you have the domain covered. Because the ecosystem's structure underlies the assessment process, revisit it when you reach Domain 5.
Domain 2: Code of Professional Conduct (5%)
Domain 2 asks you to apply the principles of the CMMC-AB Code of Professional Conduct, along with relevant ISO/IEC and DoW requirements. The verb is "apply," which signals scenario-style questions: a situation presents a conflict, a disclosure question or a temptation, and you identify the response consistent with the Code.
What to master in Domain 2
Think in terms of professional duties and the situations that test them.
- Confidentiality obligations around sensitive information an assessor encounters
- Handling conflicts of interest and maintaining impartiality
- Honest representation of qualifications and findings
- How ISO/IEC requirements and DoW requirements interact with the Code
Ethics questions reward careful reading. The wrong answers are often plausible-sounding actions that quietly violate a principle, so slow down on these. Because this domain is only 5%, a few focused study sessions are enough; the goal is to recognize the principle behind each scenario rather than to memorize wording. For a fast refresher near exam day, the CCP Cheat Sheet 2026 is a good companion.
Domain 3: Governance and Source Documents (15%)
This is where the exam moves from "who" to "what is being protected and by what authority." Domain 3 covers Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) as they exist on nonfederal unclassified networks, how to determine the roles and authority associated with FCI and CUI, and how to understand the source and supplementary documents that underpin the model.
What to master in Domain 3
The core skill is distinguishing FCI from CUI and knowing where authority for each comes from.
- The definitions of FCI and CUI and why the distinction drives which requirements apply
- Who designates, who handles and who is accountable for each information type
- The purpose and relationship of the source documents versus the supplementary documents
- How these documents feed into what an assessor evaluates
Many candidates underestimate this domain because it reads like background. In practice, it is the foundation for both Domain 4 and Domain 6: you cannot scope an environment or evaluate a practice sensibly if you are unclear about what kind of information is in play. Treat the source documents as primary reading rather than something to skim, and revisit them whenever a later domain references a requirement.
Domain 4: Model Construct and Implementation Evaluation (35%)
Domain 4 is the largest on the exam at 35% and the one that most separates prepared candidates from underprepared ones. It asks you to apply source documents to evaluate and review CMMC practices (the outline specifies at minimum Level 1 practices), to apply assessment criteria and methodology, and to analyze evidence: where it is located, how it is collected, its quality and how it is used.
What to master in Domain 4
This domain is about judgment applied to practices and evidence, not memorization of a practice list.
- How the model is constructed and how practices are organized and described
- Applying assessment objectives and methods (examine, interview, test) to determine whether a practice is met
- Distinguishing adequate evidence from weak or insufficient evidence
- Identifying where evidence lives in an environment and how it should be collected
- Reasoning at minimum through Level 1 practices, with working familiarity of how the model scales
The evidence-analysis objective deserves special attention because it is where scenario questions get subtle. A question might describe an artifact an organization produced and ask whether it is sufficient to demonstrate a practice, or which type of evidence would be most appropriate. The right answer usually depends on the assessment methodology rather than on intuition about security. Train yourself to ask: what does the practice require, what would demonstrate it, and is what is presented actually that?
Because this domain carries more than a third of the exam, it should receive the largest share of your preparation time. A structured plan for allocating that time is laid out in the CCP Study Guide 2026: How to Pass on Your First Attempt, and you can pressure-test your judgment on evidence and practice evaluation with scenario questions on the CCP practice test site.
Domain 5: CMMC Assessment Process (25%)
The CMMC Assessment Process (CAP) is the second-heaviest domain at 25%. It frames the work of a CCP across the lifecycle of an assessment, organized into four phases, plus scenario-based reasoning about Level 2 assessments.
| Phase | Focus | What the CCP must understand |
|---|---|---|
| Phase 1 | Plan and Prepare | The CCP's role in readying the assessment before fieldwork begins |
| Phase 2 | Conduct | The CCP's role while the assessment is being carried out |
| Phase 3 | Report | The CCP's role in documenting and reporting results |
| Phase 4 | Evaluate outstanding POA&M items | The CCP's role in assessing items left open on a Plan of Action and Milestones |
What to master in Domain 5
Know the phases in order, and know what the CCP does (and does not do) in each.
- The sequence and purpose of the four phases
- The CCP's specific responsibilities and boundaries within each phase
- How outstanding POA&M items are evaluated in the final phase
- Walking through Level 2 assessment phases and steps in scenario form
The phrase "CCP roles" in the outline is a hint: questions often probe where a CCP's responsibility begins and ends relative to other roles on an assessment team. Pay attention to who is accountable for what, since a plausible-sounding action may belong to a different role. If you have studied the ecosystem in Domain 1, the role distinctions here will feel familiar.
Key Takeaway
Learn Domain 5 as a story with a beginning, middle and end. If you can narrate what happens in each of the four phases and who does it, scenario questions become sequencing and role-recognition problems rather than memory tests.
Domain 6: Scoping (15%)
Scoping is the final domain at 15%, and it covers high-level CAP scoping along with analyzing an environment to scope FCI assets. In other words, before anything can be evaluated, someone must determine what is in play, and the CCP needs to understand how that determination is made.
What to master in Domain 6
The skill is deciding what falls inside the boundary of an assessment and why.
- How to identify assets that process, store or transmit FCI
- How to analyze an environment to determine what belongs in scope
- The high-level scoping considerations that apply within the assessment process
- How incorrect scoping cascades into incorrect assessment conclusions
Scoping is easy to underrate because it sounds administrative, but it shapes everything downstream. An asset wrongly left out of scope can make an assessment meaningless; an asset wrongly included can inflate the work. Scenario questions in this domain often present a description of an environment and ask what should or should not be considered in scope. Connect this domain back to Domain 3: your understanding of FCI and CUI is what lets you recognize which assets matter.
How the Six Domains Connect in Scenario Questions
The outline separates content into six domains for organizational clarity, but real exam scenarios rarely stay inside one of them. A single question might describe an organization, ask you to reason about what is in scope (Domain 6), identify the information type involved (Domain 3), judge whether evidence satisfies a practice (Domain 4), and place the activity within an assessment phase (Domain 5).
This is why studying the domains in isolation can leave gaps. Once you have a first pass through each, practice integrating them: take a scenario and tag each element with the domain it belongs to. This habit also exposes weak links. If you repeatedly stumble when a question mixes scoping and evidence, you know where to focus. Candidates who want a sense of how much integration the exam demands can review CCP Pass Rate 2026: What the Data Shows, which discusses what is and is not publicly known about outcomes. Note that ISACA does not publicly disclose a pass rate, so be wary of any specific figure you see quoted elsewhere.
Sequencing Your Domain Study
Because the domains build on one another, order matters. A sensible sequence puts the foundational material first, then the heavy evaluation domains, then the integrating domains. The timeline below is a template you can compress or stretch to fit your calendar; adjust it based on how quickly you absorb each area.
Foundations: Domains 1, 2 and 3
- Map the ecosystem authorities and their roles (Domain 1)
- Work through the Code of Professional Conduct with scenario examples (Domain 2)
- Read the source and supplementary documents closely and nail the FCI/CUI distinction (Domain 3)
The heavy core: Domain 4
- Study the model construct and how practices are organized
- Work through assessment methods and criteria on Level 1 practices first
- Drill evidence location, collection, quality and use
Process and boundaries: Domains 5 and 6
- Learn the four phases and the CCP's role in each
- Practice Level 2 assessment scenarios step by step
- Work scoping exercises that identify FCI assets in an environment
Integration and review
- Take mixed-domain practice questions and tag each by domain
- Revisit your weakest domain, weighted by its share of the exam
- Review the official outline and candidate guide for any details to verify
The reasoning behind this ordering is that Domains 1 through 3 supply the vocabulary and context that Domains 4 through 6 assume. Starting with the biggest domain before you understand FCI and CUI makes evidence analysis harder than it needs to be. For a fuller preparation framework, see the CCP Study Guide.
Exam Logistics Tied to the Outline
The domain breakdown is only part of preparing; you also need to understand how the exam is delivered. The exam is computer-based and can be taken at authorized PSI test centers or through remote proctoring. According to the current credential page, the fee is US$575 for ISACA members and US$760 for non-members, and scheduling may be available 48 hours after payment. For a deeper look at costs and what else to budget, see CCP Certification Cost 2026: Complete Pricing Breakdown and CCP Exam Dates 2026: Testing Windows, Deadlines & Scheduling.
Several details are intentionally not stated here because they must be confirmed in the current candidate guide: exam duration, the passing threshold, prerequisites, and the specifics of credential validity and renewal. These can change, and the candidate guide linked from the ISACA CCP page is the authoritative source. Pages like CCP Requirements 2026 and CCP Passing Score 2026 discuss these topics, but always cross-check anything time-sensitive against the official guide before you commit.
A note on practice material
Any practice questions you use, whether on this site or elsewhere, should be independently authored scenarios that teach the domains rather than reproductions of actual exam items or an official mock exam. The value of practice is in building the judgment the outline describes. You can try scenario-style questions on the CCP practice test as one input to your preparation.
Why this credential is worth the preparation effort
Understanding the domains also clarifies what the credential signals to employers: familiarity with how CMMC assessments are scoped, evaluated and reported. If you are weighing the investment, explore Is the CCP Certification Worth It? Complete ROI Analysis 2026 and CCP Jobs for a view of where the credential applies.
Frequently Asked Questions
The official outline lists six weighted domains: CMMC Ecosystem, CMMC-AB Code of Professional Conduct, CMMC Governance and Source Documents, CMMC Model Construct and Implementation Evaluation, CMMC Assessment Process (CAP), and Scoping. The outline also publishes 170 questions and 15 nested objectives.
Domain 4, CMMC Model Construct and Implementation Evaluation, is the largest at 35%. The CMMC Assessment Process (Domain 5) follows at 25%, so those two domains together account for 60% of the exam.
Yes. The Ecosystem and Code of Professional Conduct domains are small but approachable, and they are among the most reliable points to secure. They require less time than Domains 4 and 5, so learn them efficiently rather than skipping them.
Much of the outline uses verbs such as "apply," "analyze" and "determine," and Domain 5 explicitly references scenario-based Level 2 assessment phases and steps. Prepare to reason through situations that may combine several domains, rather than relying on pure recall.
These details are not covered here because they should be verified in the current ISACA candidate guide, linked from the official CCP credential page. A pass rate is not publicly disclosed, so treat any specific figure you encounter with caution.
Mastering the CCP domains comes down to matching your effort to their weights: lock in the lighter domains early, invest heavily in evaluation and the assessment process, and use scoping and governance to tie everything together. For related reading, the CCP Certification overview and CCP Salary Guide 2026 round out the picture of what the credential offers.