- A CCP here is a CMMC Certified Professional, an ISACA credential tied to the Cybersecurity Maturity Model Certification program.
- The published outline lists 170 questions across six weighted domains and 15 nested objectives.
- Domain 4 (Model Construct and Implementation Evaluation) carries 35%, and the Assessment Process adds another 25%.
- ISACA lists fees of US$575 for members and US$760 for non-members, with computer-based testing at PSI centers or remote proctoring.
What "CCP" Means Here
The letters CCP are shared by several unrelated credentials across different industries, which is why a search for the term returns a confusing mix of results. This article covers exactly one of them: the CMMC Certified Professional. ISACA's current exam content outline refers to it as the "Certified CMMC Professional," and the two names describe the same credential. If you have seen CCP attached to project management, payments, computing or any other field, none of that applies on this page.
CMMC stands for Cybersecurity Maturity Model Certification, the U.S. Department of War (formerly Defense) program that verifies whether companies in the defense supply chain protect sensitive unclassified information. A CCP is a person who has demonstrated working knowledge of how that program is structured, how its source documents fit together, and how assessments are planned, conducted and reported. For related framing, see our explainers on what CCP stands for and the meaning of CCP, or the broader overview at what CCP certification is.
Where the CCP Sits in the CMMC Ecosystem
ISACA describes its role in this space as the official CAICO, the CMMC Assessor and Instructor Certification Organization. In practical terms, that means ISACA is the body that develops, administers and maintains the certifications for people who participate in CMMC assessments. The CCP is the entry point into that assessor pathway.
The CMMC ecosystem has several moving parts, and Domain 1 of the exam asks you to compare the roles, responsibilities and requirements of each authority within it. A strong CCP candidate can explain who sets policy, who accredits, who certifies individuals, who performs assessments, and who is being assessed. Expect questions that hand you a situation and ask which party owns a particular responsibility.
The CCP Compared to Neighboring Roles
The CCP is not the only person present during an assessment, and understanding the boundaries is part of what the exam rewards. The table below describes the broad relationship between roles at a conceptual level; consult the official materials for authoritative definitions.
| Role | Primary Focus | Relationship to the CCP |
|---|---|---|
| CMMC Certified Professional (CCP) | Supports assessments and evaluates practice implementation | The credential covered in this article |
| Organization Seeking Certification | Scopes its environment and implements required practices | The party whose evidence the CCP helps review |
| Assessment team lead | Directs the assessment and its reporting | CCPs work within the team structure and its phases |
| Consultant or advisor | Helps organizations prepare | Often held by CCPs, subject to the Code of Professional Conduct |
Our companion piece on all six CCP exam domains goes deeper on how the ecosystem material is tested.
What a CCP Actually Does
A CCP's work is organized around the lifecycle of an assessment. The outline's Domain 5 breaks that lifecycle into four phases, and each one maps to a concrete set of duties:
- Phase 1, Plan and Prepare: understanding the CCP's role in readying an assessment before any evidence is examined.
- Phase 2, Conduct: participating in the hands-on evaluation of practices and evidence.
- Phase 3, Report: contributing to how findings are documented and communicated.
- Phase 4, evaluation of outstanding POA&M items: reviewing remaining Plan of Action and Milestones items after the main assessment.
Beyond phases, the day-to-day substance is evidence work. Domain 4 asks candidates to analyze where evidence is located, how it is collected, what makes it high quality, and how it is used to support a determination about a practice. A CCP who cannot distinguish strong evidence from weak evidence is not doing the job the credential describes.
The Exam Blueprint, Domain by Domain
The ISACA outline publishes 170 questions, six weighted domains and 15 nested objectives. The weighting is the single most useful planning fact you have. Two domains together account for 60% of the content, so they deserve the largest share of your attention.
Domain 1: CMMC Ecosystem (5%)
Compare the roles, responsibilities and requirements of the authorities that make up the CMMC ecosystem.
- Know who is responsible for what, not just the names of the bodies.
- Small weight, but the vocabulary here reappears in every other domain.
Domain 2: CMMC-AB Code of Professional Conduct, Ethics (5%)
Apply the Code of Professional Conduct principles along with the relevant ISO/IEC and Department of War requirements.
- Expect situational judgment: what a professional should do when a conflict or confidentiality issue arises.
- Ethics questions reward the most defensible action, not the most convenient one.
Domain 3: CMMC Governance and Source Documents (15%)
Understand Federal Contract Information and Controlled Unclassified Information as they exist on nonfederal unclassified networks, determine FCI and CUI roles and authority, and understand the source and supplementary documents.
- Be able to explain the difference between FCI and CUI and who decides how data is categorized.
- Know which document governs which question.
Domain 4: CMMC Model Construct and Implementation Evaluation (35%)
Apply source documents to evaluate and review CMMC practices (at minimum Level 1 practices), apply the assessment criteria and methodology, and analyze evidence location, collection, quality and use.
- The largest domain by a wide margin.
- Practice-level reasoning: given a practice and a described implementation, is the objective met?
- Evidence analysis is as important as memorizing practices.
Domain 5: CMMC Assessment Process, CAP (25%)
Describe CCP roles across the four assessment phases and work through scenario-based Level 2 assessment phases and steps.
- Sequence matters: know what happens in which phase and who does it.
- Scenario questions test whether you can place an action in the right phase.
Domain 6: Scoping (15%)
Understand high-level CAP scoping and analyze an environment to scope FCI assets.
- Identify which assets are in scope and why.
- Scoping errors cascade into every later assessment decision.
For a more detailed breakdown, read our full CCP exam domains guide, and keep our one-page CCP cheat sheet handy for last-minute review.
Format, Fees and Scheduling
ISACA's current credential page lists the following mechanics:
| Item | What ISACA Currently Lists |
|---|---|
| Exam fee, ISACA member | US$575 |
| Exam fee, non-member | US$760 |
| Delivery | Computer-based testing at authorized PSI test centers, or remote proctoring |
| Scheduling | May be available about 48 hours after payment |
| Question count (per outline) | 170 |
Fees and policies change, so treat this table as a snapshot and confirm everything on the official ISACA CCP page before paying. The same page links to the candidate guide.
One subtlety worth keeping straight: the CMMC framework and its version are separate from the publication date of the exam content outline. The outline tells you what the exam tests; the framework determines the underlying program rules. Always check which outline is current when you begin studying, and look at exam dates and scheduling guidance as you plan. For the full cost picture, including preparation spend, see CCP certification cost.
Who Hires a CCP
Demand for CCPs comes from several directions, all linked to the defense industrial base:
- Assessment and consulting firms that support organizations through readiness work and formal assessments.
- Defense contractors and subcontractors that want in-house staff who understand the model well enough to run internal gap reviews.
- Managed service and security providers that serve contractors and need credible CMMC expertise on their teams.
- Compliance and GRC teams in organizations that handle CUI and need someone fluent in the source documents.
Because the credential is tied to a specific regulatory program, its value depends heavily on whether your career touches defense work. We cover the economics in the CCP salary guide, the role landscape in CCP jobs, and the broader return question in whether the CCP is worth it. We deliberately avoid quoting salary figures here because credible numbers vary by region, employer type and prior experience.
How the Exam Tests Scenario Thinking
The outline's language is verb-heavy: compare, apply, determine, analyze. That signals an exam that wants judgment, not just recall. The scenario-based Level 2 assessment content in Domain 5 is the clearest example, but the pattern runs throughout.
What a Typical Reasoning Task Looks Like
Picture a described environment: a small contractor stores contract-related files in a cloud collaboration tool, a subset of which contains CUI. You may be asked to decide which assets are in scope, which practice is implicated by a described weakness, or which phase of the assessment a particular action belongs to. Answering well requires holding three things in your head at once: the data categories, the practice requirements, and the assessment procedure.
That is why isolated memorization underperforms. A candidate who memorizes practice names but cannot reason about evidence will struggle in Domain 4, and a candidate who knows the practices but not the phase structure will lose points in Domain 5.
Key Takeaway
Train yourself to ask three questions on every scenario: What data is involved (FCI or CUI)? What practice or objective applies? Which assessment phase or role is the question really about? Most wrong answers come from skipping one of these.
You can build this habit with timed scenario drills on our CCP practice test platform. All practice items we provide are independently authored and are not actual exam questions or an official mock exam.
A Domain-Weighted Prep Sequence
Rather than a generic calendar, build your schedule around the weighting. This sketch assumes several weeks of part-time study; compress or stretch it to fit your background.
Foundations: Domains 1, 2 and 3
- Learn the ecosystem vocabulary first, since every later domain borrows it.
- Read the source documents and sort FCI from CUI until the distinction is automatic.
- Review the Code of Professional Conduct principles.
Domain 4: the 35% block
- Work through practices at Level 1 and above, focusing on what evidence would demonstrate each objective.
- Practice distinguishing evidence quality, not just evidence presence.
Domain 5 and Domain 6 together
- Walk the four assessment phases end to end, then practice scoping an environment to identify FCI assets.
- Link the two: scoping decisions shape what gets assessed in Phase 2.
Integration
- Take mixed-domain practice sets and review every miss against the source documents.
- Re-read the official outline and tick off all 15 objectives.
For a fuller plan, see our CCP study guide, and if you are weighing effort, read how hard the CCP exam really is. Structured courses and coaching options are summarized under CCP training.
Where to Go From Here
If you are still deciding whether this credential fits your path, start with the official outline and candidate guide at ISACA, then compare what you read against your current role. If your work already touches defense contracting, compliance or security assessment, the CCP is a logical credential to evaluate. If it does not, consider whether the program's narrow focus matches your goals. Our CCP certification overview and the shorter explainers what is CCP and what does CCP mean offer additional angles.
When you are ready to test your readiness, begin with a diagnostic on our practice test site, note which domains lag, and let the weighting guide where you spend your next study hours.
Frequently Asked Questions
A CCP is a CMMC Certified Professional, a credential administered through ISACA, which serves as the official CAICO. ISACA's current outline calls it the Certified CMMC Professional. It validates knowledge of the CMMC ecosystem, source documents, practice evaluation, the assessment process and scoping.
The published outline lists 170 questions across six weighted domains and 15 nested objectives. Domain 4 is the largest at 35%, followed by the CMMC Assessment Process at 25%, with Governance and Source Documents and Scoping at 15% each.
ISACA's current page lists US$575 for members and US$760 for non-members. Fees can change, so confirm on the official credential page before you register, and budget separately for any preparation materials.
It is a computer-based test available at authorized PSI test centers or through remote proctoring. Scheduling may be available roughly 48 hours after payment. Duration and the passing threshold should be verified in the current candidate guide.
ISACA does not publicly disclose a pass rate, so no authoritative figure exists. Be cautious of any specific percentage quoted online, and focus on mastering the weighted domains, especially Domain 4 and the assessment process.