- CCP Defined: The CMMC Certified Professional Credential
- Why the CMMC Ecosystem Needs CCPs
- What a CCP Actually Does on an Assessment
- How the CCP Exam Is Built
- The Six Domains, Explained
- Registration and Fee Mechanics
- Who Hires CCPs
- Sequencing Your Preparation by Domain
- What to Verify Before You Commit
- Frequently Asked Questions
- CCP here means CMMC Certified Professional, an ISACA credential whose current outline titles it "Certified CMMC Professional."
- The published outline lists 170 questions across six weighted domains and 15 nested objectives.
- Domain 4 (Model Construct and Implementation Evaluation) is the largest at 35%; the CMMC Assessment Process follows at 25%.
- The current page lists US$575 for members and US$760 for non-members, delivered by CBT at PSI centers or remote proctoring.
CCP Defined: The CMMC Certified Professional Credential
On this site, CCP means CMMC Certified Professional. It is the credential for people who support Cybersecurity Maturity Model Certification (CMMC) assessments and the organizations preparing for them. The acronym is shared with several unrelated credentials in other industries, and nothing about those applies here. If you want the short-form explanations, our pages on what CCP stands for and what CCP certification is cover the naming question from different angles.
One naming wrinkle is worth knowing. The current ISACA exam content outline refers to the credential as "Certified CMMC Professional," while the widely used name is CMMC Certified Professional. They describe the same credential. ISACA states that it serves as the official CAICO, the CMMC Assessor and Instructor Certification Organization, and the authoritative materials live on ISACA's pages: the official exam content outline and the credential page with the candidate guide link.
Why the CMMC Ecosystem Needs CCPs
CMMC exists to verify that organizations handling Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) on nonfederal unclassified networks actually implement required cybersecurity practices. Verification at scale needs trained people. Assessments involve planning, evidence collection, practice-by-practice evaluation and reporting, and those tasks require professionals who understand both the model and the rules of engagement.
The CCP is the entry point into that workforce. It signals that the holder understands how the ecosystem is organized, how practices are evaluated, how evidence is judged and how professional conduct is expected to look. It is a credential about assessment participation and evaluation competence, not a general cybersecurity credential. If you are weighing it against broader options, see our analysis of whether the CCP certification is worth it.
What a CCP Actually Does on an Assessment
The exam outline is explicit about the CCP's role across assessment phases, which tells you what the credential is meant to prepare you to do:
- Phase 1, Plan and Prepare: understand the CCP's responsibilities when an assessment is being set up and scoped.
- Phase 2, Conduct: take part in evaluating practices and gathering and weighing evidence.
- Phase 3, Report: support the reporting of assessment results.
- Phase 4, evaluation of outstanding POA&M items: understand how items on a Plan of Action and Milestones are assessed after the main assessment.
Notice the pattern: the outline frames the CCP as a participant with defined responsibilities inside a structured process. Candidates who treat the exam as pure memorization of practice statements tend to be surprised by how much of it is about who does what, when, and with what authority.
How the CCP Exam Is Built
The published outline lists 170 questions, organized into six weighted domains with 15 nested objectives. Delivery is computer-based testing (CBT), either at authorized PSI test centers or through remote proctoring.
Several details are intentionally not asserted here because they must come from the current candidate guide: the exam duration, the pass threshold, and the prerequisite and renewal rules. ISACA does not publicly disclose a pass rate, so any figure you see quoted elsewhere should be treated with suspicion. Our pages on the CCP passing score and CCP pass rate explain what is and is not knowable, and CCP requirements covers eligibility questions.
Question style
Expect a mix of recall and applied judgment. Domains 4 and 5 in particular call for scenario reasoning: given a described situation, decide which practice is implicated, whether the evidence is adequate, or which assessment step comes next. The outline's own wording supports this, with objectives about analyzing evidence location, collection, quality and use, and about scenario-based Level 2 assessment phases and steps.
The Six Domains, Explained
| Domain | Name | Weight |
|---|---|---|
| 1 | CMMC Ecosystem | 5% |
| 2 | CMMC-AB Code of Professional Conduct (Ethics) | 5% |
| 3 | CMMC Governance and Source Documents | 15% |
| 4 | CMMC Model Construct and Implementation Evaluation | 35% |
| 5 | CMMC Assessment Process (CAP) | 25% |
| 6 | Scoping | 15% |
For a deeper walk-through of each content area, see the full CCP exam domains guide. Here is what each domain asks of you.
Domain 1: CMMC Ecosystem (5%)
Compare the roles, responsibilities and requirements of the authorities that make up the ecosystem.
- Know who does what, and which body has authority over which function.
- Be able to distinguish similar-sounding roles under exam pressure.
Domain 2: CMMC-AB Code of Professional Conduct (Ethics) (5%)
Apply the principles of the Code of Professional Conduct, alongside ISO/IEC and DoW requirements.
- Expect situational questions about conflicts, confidentiality and professional behavior.
- Small weight, but the answers are usually winnable with careful reading.
Domain 3: CMMC Governance and Source Documents (15%)
Understand FCI and CUI in nonfederal unclassified networks, determine FCI/CUI roles and authority, and understand source and supplementary documents.
- Be able to explain the difference between FCI and CUI and who decides what is CUI.
- Know which document is the source of which requirement.
Domain 4: CMMC Model Construct and Implementation Evaluation (35%)
Apply source documents to evaluate and review CMMC practices (at minimum Level 1 practices), apply assessment criteria and methodology, and analyze evidence location, collection, quality and use.
- This is the heaviest domain, so it deserves the largest share of your study time.
- Practice judging whether a described piece of evidence actually demonstrates a practice.
Domain 5: CMMC Assessment Process (CAP) (25%)
Know the CCP's role in each of the four phases and work through scenario-based Level 2 assessment phases and steps.
- Memorize the phase sequence and what belongs in each phase.
- Practice ordering and attribution: which step comes next, and who owns it.
Domain 6: Scoping (15%)
Understand high-level CAP scoping and analyze the environment to scope FCI assets.
- Scoping errors cascade into everything else, which is why it appears as its own domain.
- Practice identifying which assets are in scope given a described environment.
Registration and Fee Mechanics
The current credential page lists US$575 for ISACA members and US$760 for non-members. The exam is delivered by CBT at authorized PSI test centers or via remote proctoring, and scheduling may become available about 48 hours after payment. That last detail matters for planning: do not pay on the same day you hope to test.
Fees and policies change, so treat the credential page as the source of truth, not any third-party summary, including this one. For a full breakdown of what else to budget beyond the exam fee, read our CCP certification cost guide, and for scheduling specifics see CCP exam dates.
| Item | What the current information says |
|---|---|
| Member fee | US$575 |
| Non-member fee | US$760 |
| Delivery | CBT at authorized PSI test centers or remote proctoring |
| Scheduling | May be available 48 hours after payment |
| Duration, pass threshold, prerequisites, renewal | Verify in the current candidate guide |
Who Hires CCPs
Demand for CCPs comes from the organizations that sit on either side of an assessment:
- Assessment organizations that need credentialed staff to support assessment teams through the four phases.
- Defense contractors and subcontractors that handle FCI or CUI and need staff who understand what an assessor will look for.
- Consultancies and managed service providers that help contractors scope, remediate and prepare for assessment.
- Compliance and security teams inside contractors that want an internal expert on the model and the process.
Because the credential is specific to CMMC, the strongest job fit is in the defense industrial base and the firms that serve it. Our pages on CCP jobs and the CCP salary guide go into role types and compensation framing; we avoid quoting specific pay figures here because reliable, current numbers should be checked against live job postings.
Sequencing Your Preparation by Domain
You do not need a generic study system. You need an order that matches how the domains build on each other. A workable sequence follows the logic of the weighting:
Foundations: Domains 1 and 3
- Learn the ecosystem roles and the FCI/CUI concepts first; everything else assumes them.
- Build a source-document map: which document says what.
Scoping and Ethics: Domains 6 and 2
- Practice scoping FCI assets from described environments.
- Read the Code of Professional Conduct once, then work conduct scenarios.
The big one: Domain 4
- Work through practices and assessment criteria systematically.
- For each practice, ask what evidence would convince an assessor, and where it would live.
Process: Domain 5
- Walk the four phases repeatedly until the sequence is automatic.
- Do scenario drills on Level 2 assessment steps.
Scoping goes before the big evaluation domain because you cannot judge practices sensibly until you know what is in scope. For the broader plan, our CCP study guide expands this into a full approach, and the CCP cheat sheet is useful for a final-days review once you have done the real learning. If you want to see how you stand across all six areas, try the practice questions on the main practice test site.
Key Takeaway
Spend roughly half your study time on Domains 4 and 5, but do not skip the small domains. Domains 1 and 2 are low-weight and relatively learnable, which makes them efficient points. Our practice items are independently authored for study purposes; they are not actual exam questions or an official mock exam.
What to Verify Before You Commit
A few facts are deliberately left to the source because they are easy to get wrong secondhand:
- Exam duration and passing threshold. Confirm in the candidate guide. See also what we can and cannot say about the CCP passing score.
- Prerequisites and eligibility. The guide governs. Our requirements page summarizes how to approach the question.
- Validity and renewal. Detailed rules must be read directly in the current guide.
- Difficulty. Subjective, but discussed realistically in how hard the CCP exam is.
If you are still orienting yourself, the explainer pages What Is CCP?, CCP Meaning and the broader CCP certification overview offer additional entry points, and CCP training covers preparation options.
Frequently Asked Questions
CMMC Certified Professional. The current ISACA outline titles it "Certified CMMC Professional." It is unrelated to other credentials that share the CCP acronym.
The published outline lists 170 questions across six weighted domains and 15 nested objectives. Confirm the scored versus unscored breakdown and timing in the current candidate guide.
Domain 4, CMMC Model Construct and Implementation Evaluation, at 35%. The CMMC Assessment Process (Domain 5) is next at 25%, so together they make up 60% of the weighting.
The current page lists US$575 for members and US$760 for non-members. Verify on ISACA's credential page before paying, since fees can change.
By computer-based testing at authorized PSI test centers or through remote proctoring. Scheduling may be available about 48 hours after payment.