CMMC Certified Professional (CCP) exam

ISACA publishes the blueprint below. The percentages are the share of the exam each area accounts for — not separate hurdles, since scoring is based on the total number of questions answered correctly. Every lesson sits under its area and reads in the app.

• D1

  CMMC Ecosystem

  4 lessons · free to every account

  5%of the exam

  • Why CMMC exists: the authorities behind it
  • The organizations: OSC, C3PAO, RPO, LPP and LTP
  • The individuals: RP, PA, PI, CCP, CCA and CCI
  • The assessment team: members and the Lead Assessor
• D2

  CMMC-AB Code of Professional Conduct (Ethics)

  3 lessons

  5%of the exam

  • The frameworks behind the Code of Professional Conduct
  • Objectivity, confidentiality, proper use of methods and information integrity
  • Conflicts of interest, intellectual property, lawful practice and NDAs
• D3

  CMMC Governance and Source Documents

  8 lessons

  15%of the exam

  • The regulatory chain: 32 CFR, DFARS and clause 252.204-7012
  • CMMC 2.0 tenets and the rulemaking timeline
  • Levels and assessment types: FAR 52.204-21, NIST SP 800-171, self and third-party
  • Consequences of noncompliance
  • FCI and CUI defined
  • Who identifies and marks CUI, and who must protect it
  • The CMMC document set
  • The CUI registries and their markings
• D4

  CMMC Model Construct and Implementation Evaluation

  21 lessons

  35%of the exam

  • Model architecture, levels and the anatomy of a practice
  • The 14 domains and the Level 2 requirements at a glance
  • AC.L1-3.1.1 – Authorized Access Control
  • AC.L1-3.1.2 – Transaction and Function Control
  • AC.L1-3.1.20 – External Connections
  • AC.L1-3.1.22 – Control Public Information
  • IA.L1-3.5.1 – Identification
  • IA.L1-3.5.2 – Authentication
  • MP.L1-3.8.3 – Media Disposal
  • PE.L1-3.10.1 – Limit Physical Access
  • PE.L1-3.10.3 – Escort Visitors
  • PE.L1-3.10.4 – Physical Access Logs
  • PE.L1-3.10.5 – Manage Physical Access
  • SC.L1-3.13.1 – Boundary Protection
  • SC.L1-3.13.5 – Public-Access System Separation
  • SI.L1-3.14.1 – Flaw Remediation
  • SI.L1-3.14.2 – Malicious Code Protection
  • SI.L1-3.14.4 – Update Malicious Code Protection
  • SI.L1-3.14.5 – System and File Scanning
  • Assessment criteria and methods
  • Evidence: adequacy and sufficiency
• D5

  CMMC Assessment Process (CAP)

  8 lessons

  25%of the exam

  • The CMMC Assessment Process and its four phases
  • Phase 1: analyzing requirements and validating evidence criteria
  • Phase 1: the assessment plan and the readiness review
  • Phase 2: collecting and examining evidence
  • Phase 2: rating practices and validating preliminary results
  • Phase 2: final findings and practices on a POA&M
  • Phase 3: the assessment report
  • Phase 4: POA&M close-out
• D6

  Scoping

  5 lessons

  15%of the exam

  • Organizational scoping: organization, host unit, supporting units
  • FCI assets in scope
  • Specialized assets
  • Scoping activities: people, technology, facilities and ESPs
  • Level 2 scoping: the five asset categories