Written and maintained by CASRAI Editorial Board
Last updated
The CMMC CCP is the Certified CMMC Professional credential, the entry-level individual certification in the Cybersecurity Maturity Model Certification ecosystem. As described on the official ISACA page on 2026-10-29, it is the first step toward becoming a Certified CMMC Assessor (CCA), and a CCP cannot make final determinations on a CMMC assessment. Older write-ups still describe Cyber AB-era rules; the figures below are the current ISACA ones, each dated 2026-10-29.
What the CMMC CCP is and who runs it
The CCP is aimed at professionals and consultants looking to become part of the CMMC ecosystem. It validates readiness to help organizations prepare for CMMC assessments or to participate on a CMMC assessment team during official assessments.
Responsibility is split between two bodies. As described on the official ISACA pages on 2026-10-29:
- ISACA, acting as the CMMC Assessor and Instructor Certification Organization (CAICO), manages the training, examination and professional certification for individuals, across the CCA, Lead CCA, CCP and CCI credentials.
- The Cyber AB remains the accreditation body of the CMMC program and continues to run point on Tier 3 investigations for CCPs and CCAs.
That split is the main change from older write-ups, which describe the Cyber AB as the exam and certification owner.
CCP eligibility
As described on the ISACA CCP page on 2026-10-29, there is no listed degree or years-of-experience prerequisite. It states that eligibility is established at the time of exam registration and is good for six months. The requirements it does set are about process rather than background:
- Complete the mandatory CCP training through an Accredited Training Partner (ATP) listed on the Cyber AB Marketplace before earning the certification.
- Register for, pay for and pass the CCP exam.
- Pay the application processing fee and submit the certification application.
- Attain a positively adjudicated Tier 3 background investigation by the DoW.
- Follow ISACA’s Code of Professional Ethics and its continuing professional education (CPE) policy.
Source: ISACA, CCP credential page, checked 2026-10-29.
What the CCP requires: training, exam and fees
As described on the official ISACA page on 2026-10-29:
| Item | As described on the official page |
|---|---|
| Training | Mandatory, delivered by an ATP found on the Cyber AB Marketplace |
| Exam fee, ISACA member | US$575 |
| Exam fee, non-member | US$760 |
| Application processing fee | US$200, due before certification |
| Exam window | Six months from the date you register |
| Application window after passing | Five years from passing the exam to apply for certification |
| Exam delivery | Computer-based, at PSI test centers or remotely proctored |
Exam registration fees must be paid in full before you can schedule. Fees and rules change, so check the official page before paying. Training fees are set by each ATP and are separate from the amounts above.
Application and compliance steps
- Choose an ATP on the Cyber AB Marketplace and complete the CCP training.
- Register for the CCP exam with ISACA and pay the exam fee in full.
- Schedule and take the exam within the six-month window.
- After passing, apply for certification within five years of the pass date and pay the application processing fee.
- Complete the Tier 3 background investigation. Per the ISACA CMMC page, the Cyber AB continues to run point on Tier 3 investigations for CCPs and CCAs.
- Maintain the certification under the ISACA CPE policy: a minimum of 20 CPE each year and 120 in each three-year cycle, of which at least 90 must relate to the certification and two of those to CMMC rules (identified each year). The remaining 30 can be general professional development such as leadership or mentorship.
Source: ISACA, CMMC credentialing page, checked 2026-10-29. Use the official page for the current renewal rules and fees.
Typical timeline phases
The official pages give windows, not fixed durations, so the phases below follow the order the requirements impose:
- Training. Completed with an ATP before certification is earned.
- Exam registration and sitting. The six-month window opens at registration; scheduling is possible only after full payment.
- Application. Open for five years after a pass.
- Background investigation. Starts after the application; ISACA validates the application and the Cyber AB runs the Tier 3 process.
- Certification and CPE cycle. Annual and three-year CPE minimums apply from then on.
What a CCP can and cannot do
The ISACA CMMC page states that a CCP holding a favorable Tier 3 determination can participate on a CMMC Level 2 assessment only to verify Level 1 practices, and that CCPs cannot make final determinations on a CMMC assessment. Those belong to CCAs. For how the assessment itself works, see CMMC Level 2 assessment: self vs C3PAO, scoring and POA&M rules.
Common mistakes
- Assuming old prerequisites. Degree and work-experience requirements quoted on older pages are not listed on the current ISACA CCP page. Check the official page rather than a training vendor’s summary.
- Confusing the CCP with the CCA. The CCP is the entry credential. A CCP is eligible to become a CCA, but that path needs further approved training and a separate exam.
- Treating the CCP as assessor authority. A CCP cannot make final determinations on an assessment.
- Letting a window lapse. The exam must be taken within six months of registering, and the certification application filed within five years of passing.
- Budgeting only the exam fee. The application processing fee and the ATP training cost are separate.
Related programs
| Credential | What the ISACA pages say, checked 2026-10-29 |
|---|---|
| CMMC Certified Professional (CCP) | Entry credential; first step toward becoming a CCA |
| CMMC Certified Assessor (CCA) | A CCP is eligible to become a CCA; the candidate also completes training with an Approved Training Provider and passes the CCA exam |
| Lead CCA and CCI | Also trained, examined and certified through ISACA as CAICO |
For the organization-side program these credentials support, see DFARS 252.204-7021, the CMMC scoping guide, CMMC Level 1 self-assessment and CMMC compliance for universities and research institutions.
FAQ
What does CCP stand for in CMMC?
Certified CMMC Professional, the entry-level individual credential in the CMMC program.
Who issues the CCP now?
ISACA, as the CAICO, manages training, examination and certification. The Cyber AB remains the program’s accreditation body and runs Tier 3 investigations.
How much does the CCP exam cost?
As described on the official page on 2026-10-29: US$575 for ISACA members and US$760 for non-members, plus a US$200 application processing fee.
Do you need the CCP before becoming a CCA?
ISACA positions the CCP as the entry point. ISACA’s CMMC page says that after passing the CCP exam an individual can begin the CCA process.
Sources
- ISACA, Certified CMMC Professional (CCP), checked 2026-10-29.
- ISACA, CMMC credentialing, checked 2026-10-29.
