CMMC CCP Credential Supports Assessments but Cannot Make Final Determinations

The Certified CMMC Professional (CCP) is an entry-level individual credential in the Cybersecurity Maturity Model Certification ecosystem. It is intended for professionals and consultants seeking to help organizations prepare for assessments or participate on official assessment teams. The credential is also a pathway toward becoming a Certified CMMC Assessor, but it does not authorize its holder to make final determinations in a CMMC assessment. For contractors supporting CMMC Level 2 assessments, that boundary matters: CCPs may verify Level 1 practices as described in the source, but they should not be treated as substitutes for personnel authorized to issue final assessment determinations.

Responsibilities for the credential are divided between ISACA and the Cyber AB. ISACA serves as the CMMC Assessor and Instructor Certification Organization (CAICO), managing training, examinations, and individual professional certifications, including CCP credentials. The Cyber AB remains the program’s accreditation body and continues to handle Tier 3 investigations for CCPs and Certified CMMC Assessors. This allocation differs from older descriptions that identify the Cyber AB as the owner of exams and certifications, so contractors relying on prior guidance should verify current requirements before making staffing or credentialing decisions.

The credentialing process combines mandatory training, examination, an application, and a background determination. Candidates must complete CCP training through an Accredited Training Partner listed on the Cyber AB Marketplace, register for and pass the exam, pay the application processing fee, and submit the certification application. They must also receive a positively adjudicated Tier 3 background investigation by the Department of War (DoW) and comply with ISACA’s Code of Professional Ethics and continuing professional education policy. The source reports no listed degree or years-of-experience prerequisite; eligibility is established at exam registration and remains valid for six months.

The listed exam fee is $575 for ISACA members and $760 for nonmembers, with a separate $200 application processing fee due before certification. Exam registration fees must be paid in full before scheduling. Candidates have six months from registration for the exam window and up to five years after passing to apply for certification. The exam is computer-based, offered at PSI test centers or through remote proctoring. Training costs are set separately by each Accredited Training Partner, and the source cautions that fees and rules can change. For contractors, this is a workforce-planning and compliance consideration—not an open procurement opportunity or a contract award.

• ISACA administers CCP training, examinations, and individual certification as the CAICO; the Cyber AB retains accreditation and Tier 3 investigation responsibilities.
• CCPs can support the limited Level 1 practice verification described, but cannot make final CMMC assessment determinations.
• Candidates must complete mandatory training through an Accredited Training Partner listed on the Cyber AB Marketplace.
• The CCP exam costs $575 for ISACA members or $760 for nonmembers; the application processing fee is $200.
• The exam is computer-based at PSI test centers or remotely proctored; registration fees must be paid before scheduling.
• Candidates have six months from exam registration to take the exam and five years after passing to apply for certification.
• Certification requires a favorable Tier 3 background investigation by the DoW, along with compliance with ISACA ethics and continuing education policies.
• No degree or minimum years-of-experience prerequisite is listed in the cited ISACA requirements; eligibility is established at registration.
• Training fees are set by individual Accredited Training Partners and are separate from the stated exam and application fees.
• Contractors should budget for training, fees, and assessment-team role boundaries, and confirm current requirements with official sources before enrolling or assigning staff.