CMMC CCP Exam Guide 2026: Certified CMMC Professional
CCP is the entry credential for the CMMC assessment ecosystem — and the one with the most administrative traps. Certification activities moved to ISACA in April 2026.
On this page
CCP — Certified CMMC Professional — is the entry credential in the Cybersecurity Maturity Model Certification ecosystem. It is the prerequisite for becoming a Certified CMMC Assessor (CCA), and it is what most people in the defence-contracting supply chain encounter first.
As of April 2026, CMMC certification activities moved to ISACA, now acting as the CMMC Assessor and Instructor Certification Organization (CAICO). A lot of guidance still online describes the older Cyber AB process. Verify current requirements, fees and training providers with ISACA before you pay for anything.
What CCP certifies
CCP validates that you understand the CMMC framework and the assessment process well enough to support an assessment — not to lead one, which is the CCA's role. In practice CCP holders work as consultants preparing organisations for assessment, as assessment team members, and inside defence contractors owning CMMC readiness.
The exam covers six domains spanning the CMMC framework itself and the assessment process around it. Because the model and its procedures are revised periodically, treat the current official exam objectives as authoritative over any third-party summary, this one included.
Recommended background
There is no hard prerequisite, but the programme recommends a college degree in a cyber or IT field, or two or more years of related experience or education, or two years of equivalent experience including military service, in a cyber, IT or assessment field.
Exam format and real cost
170 questions in 210 minutes is the number to internalise. That is about 74 seconds each with no margin for a leisurely first pass. This is a long, endurance-style paper closer to CISSP in shape than to a 45-minute fundamentals exam.
The headline is the ~$275 exam fee. The real outlay includes a separate ~$200 application fee for your CMMC Professional Number (CPN), and authorised training which is typically $2,000–$4,000 depending on provider and format. Budget three to four thousand dollars, not three hundred.
The steps people miss
CCP is unusual among IT certifications in how much of it is administrative. The exam is only one gate.
Sequence and timing vary as ISACA takes over administration — confirm the current order before committing, particularly whether training must precede your exam booking.
CCP versus CCA
| CCP | CCA | |
|---|---|---|
| Role | Supports assessments; advises on readiness | Leads certification assessments |
| Prerequisite | Recommended background only | Active CCP status |
| Training | Authorised CCP training required | Separate authorised CCA training |
| Exam | 170 questions, 3.5 hours | Separate examination |
| Start here if | You are new to CMMC, or preparing an organisation | You already hold CCP and want to assess |
There is no route to CCA that skips CCP, so if assessing is the goal, CCP is step one rather than an optional credential.
Why CMMC exists, and why that shapes the exam
CMMC is a US Department of Defense programme. Its purpose is to verify that contractors handling sensitive but unclassified information actually implement the protections they have long been required to claim. Self-attestation proved unreliable, so third-party assessment was introduced.
That origin explains the exam's character. CMMC is compliance-shaped, not technology-shaped — it cares less about whether you can configure a firewall than about whether a required practice is met, how that is evidenced, and who is entitled to say so. If you come from a hands-on security background, that is the adjustment to make.
For every practice, train yourself to ask three questions: what does the practice require, what evidence demonstrates it, and what is the assessment procedure for verifying it? Exam scenarios are usually probing one of those three, and identifying which one resolves most of the apparent ambiguity.
Who should take CCP
| If you are… | Verdict |
|---|---|
| A consultant preparing defence contractors for assessment | Strong fit — the core audience |
| Aiming to become a certified assessor (CCA) | Required — active CCP is the prerequisite |
| In-house at a contractor, owning CMMC readiness | Good fit, and it carries weight with primes |
| A security engineer with no US defence exposure | Weak fit — high cost, jurisdiction-specific scope |
| Outside the US defence supply chain entirely | Skip it. ISO 27001 or vendor security certifications travel further |
That last row matters given the price. CCP is valuable precisely because it is narrow — it certifies you against one government programme. Outside that supply chain, three to four thousand dollars buys considerably more career mobility elsewhere.
How to prepare
Three things separate people who pass from people who resit.
Know the source documents, not summaries. CMMC is built on published standards, and the exam rewards people who have read the actual practices and assessment procedures rather than a course deck about them. When a question turns on precise wording, secondhand material fails.
Practise the pacing. 170 questions in 3.5 hours punishes anyone who lingers. Take full-length timed practice sets, not ten-question drills — the failure mode here is fatigue and clock mismanagement rather than knowledge gaps.
Separate the framework from the process. Roughly, the exam asks two kinds of question: what does the model require? and how is an assessment actually conducted? Candidates from a compliance background tend to be strong on the first and weak on the second. Study assessment procedure deliberately, as its own subject.
Much of real CMMC work — and a fair share of exam scenarios — comes down to scoping: which assets are in scope, and why. When a scenario feels ambiguous, ask what is in scope first. The answer usually falls out of that.
When you are ready to test yourself under real conditions, the CCP practice test runs full-length timed sets, and the study-time calculator will size a schedule around your available hours.
Frequently Asked Questions
How many questions is the CMMC CCP exam?
170 multiple-choice questions with 3.5 hours (210 minutes) to complete them. That is roughly 74 seconds per question, so pacing matters.
How much does CCP actually cost?
The exam fee is around USD $275, plus roughly USD $200 for the application that issues your CMMC Professional Number (CPN). Authorised training is separate and commonly runs USD $2,000 to $4,000.
Who administers CMMC certification now?
As of April 2026 certification activities moved to ISACA, which serves as the CMMC Assessor and Instructor Certification Organization (CAICO). Check ISACA for current procedures rather than older Cyber AB material.
Do I need CCP before CCA?
Yes. Active CCP status is the foundation prerequisite for CCA candidacy. CCP also requires completing authorised training, passing the exam, and maintaining continuing professional education.
Practise CCP Before You Book
500+ CCP practice questions with worked explanations across the CMMC framework and assessment process.
CCP Practice Test
Practice Before You Book
500–1,000+ practice questions per exam with detailed explanations, across Azure, AWS, GCP, security, and AI certifications.