Written and maintained by CASRAI Editorial Board
Last updated
A CMMC Registered Practitioner (RP) is an individual who has registered with the Cyber AB, the CMMC accreditation body, to provide implementation consulting to organizations preparing for a Cybersecurity Maturity Model Certification (CMMC) assessment. The RP is a Cyber AB ecosystem credential. The Cyber AB role page does not present it as a requirement for an organization to be certified, and an RP does not conduct assessments. This guide summarizes the credential as described on the official Cyber AB page on 2026-10-29, and sets out what the credential does and does not allow.
What a CMMC Registered Practitioner is and who runs it
The Cyber AB describes itself as the sole official non-governmental partner of the Department of War for the authorization, accreditation and administration of the CMMC Ecosystem. Within its Consulting and Implementation roles, the Registered Practitioner is the individual designation. Per the Cyber AB role page, an RP may provide implementation consulting to identify gaps and suggest mitigations for an organization seeking certification (an OSC) that is preparing for assessment. An RP may work for a Registered Practitioner Organization (RPO) or be contracted individually.
The RP credential sits on the preparation side of the program. Assessment sits with a different part of the ecosystem: see the guides on the Certified CMMC Professional (CCP), the CMMC Assessment Process (CAP) and the C3PAO for those roles.
Does an RP replace a C3PAO or an assessor?
No. An RP advises on implementation; it does not certify anyone. The Cyber AB page also sets an independence limit: individuals who hold both RP or RPA and assessor certifications “cannot assess a company if they have previously assisted with an implementation for that same company.” In practice that means a person who helped build your program cannot then be the one who assesses it. A Registered Practitioner Organization is likewise a consulting firm, not a C3PAO.
Eligibility and requirements (summary, with the official source)
As described on the Cyber AB Consulting and Implementation page on 2026-10-29, an individual applying for RP status must:
- register with and be authorized by the Cyber AB;
- pass a commercial background check (international background checks cost $125 USD and are billed separately);
- complete online training and the course exams;
- sign and acknowledge the Cyber AB Code of Professional Conduct and an RP Agreement.
Source: Cyber AB, Consulting and Implementation roles.
What it costs
As described on the official page on 2026-10-29, the RP fee is $600, covering application, training and testing, with a $500 annual renewal. The page states that the registration duration is approximately 3 weeks including the background check. If you later attain the Registered Practitioner Advanced (RPA) designation, you renew only the RPA. The page states that fees are non-refundable and carries a footnote that the schedule does not include training, testing or examination fees, which sits oddly beside the table listing training and testing in the 00; confirm with the Cyber AB what the fee covers before paying. Fees are set by the Cyber AB and can change, so read the current schedule on the official page before budgeting.
Application and compliance steps
- Apply to the Cyber AB and pay the application fee.
- Pass the commercial background check.
- Complete the online training and course exams. The page states two attempts are allowed on the final exam; after a second failure you must reapply after a 30-day cool-down period.
- Sign the Code of Professional Conduct and the RP Agreement.
- Renew annually to stay registered.
The Cyber AB states that an application expires one year after it is submitted if training and testing are not completed, and fees paid are lost.
Typical timeline phases
The phases are application, background check, training and exams, then agreement signing. The Cyber AB gives an overall registration duration of approximately 3 weeks including the background check. Because the application expires after one year, the main schedule risk is leaving training and testing unfinished.
RP, RPA and RPO compared
| Designation | Who it is for | Fee (as described 2026-10-29) | Renewal | Notable requirement |
|---|---|---|---|---|
| Registered Practitioner (RP) | Individual consultant | $600 application, training and testing | $500 per year | Background check, training and exams, Code of Professional Conduct, RP Agreement |
| Registered Practitioner Advanced (RPA) | Individual with deeper implementation experience | $1,000 application, training and testing | $750 per year | Must be an active RP; implemented 50+ cybersecurity framework controls that correlate to the 110 CMMC Level 2 practices |
| Registered Practitioner Organization (RPO) | Advisory firms and managed service providers in the defense supply chain | $6,000 application | $5,000 per year | Organizational background check (DUNS number); at least one associated RP; Code of Professional Conduct and RPO Agreement |
Where the program stands after the July 2026 Phase II suspension
In a statement dated 2026-07-15, the Cyber AB reported that the Pentagon suspended the CMMC Phase II requirements for a 60-day review by a CMMC Reform Task Force. The Cyber AB stated that only the Phase II implementation requirements were suspended and that other program elements remain operational, including Registered Practitioner support services and C3PAO Level 2 assessments. It also stated that NIST SP 800-171 and DFARS 252.204-7012 requirements remain in place. The same statement cited more than 2,000 Registered Practitioners and 400 Registered Practitioner Organizations in the ecosystem. Program status is moving, so check the Cyber AB site for the current position.
Common mistakes
- Treating the RP as a certification of your organization. It is a credential for a consultant.
- Using the same person as implementation consultant and assessor. The Cyber AB independence limit above bars it.
- Letting the application lapse: it expires after one year and the fees are lost.
- Confusing RP with RPA, which costs more and carries a 50+ control implementation requirement.
Does this matter for research institutions?
A university or research lab handling controlled unclassified information under defense contracts still has to implement the NIST SP 800-171 requirements whether or not it hires an RP. An RP or RPO is one way to get outside help with gap analysis and mitigation planning; it is optional. For the institutional picture see CMMC compliance for research institutions and the CMMC Level 2 assessment guide.
FAQ
What does CMMC RP stand for?
RP stands for Registered Practitioner, the Cyber AB credential for individuals who provide CMMC implementation consulting.
Is an RP required for CMMC certification?
The Cyber AB role page does not list an RP as a requirement for an organization to be assessed. RP is an ecosystem role for consultants.
Can an RP assess my organization?
An RP advises on implementation. The Cyber AB states that people holding both RP/RPA and assessor certifications cannot assess a company they previously helped implement.
How much does it cost to become an RP?
$600 for application, training and testing and $500 a year to renew, as described on the official page on 2026-10-29.
Sources
- Cyber AB, CMMC Ecosystem Roles: Consulting and Implementation (https://cyberab.org/CMMC-Ecosystem/Ecosystem-Roles/Consulting-and-Implementation), date checked 2026-10-29.
- Cyber AB, Statement on the Department of War’s suspension of CMMC Phase II requirements, dated 2026-07-15 (https://www.cyberab.org/Portals/0/Documents/CyberABStatementOnDoWPhaseIISuspension-15JUL2026.pdf), date checked 2026-10-29.
