Who's who in CMMC: every role on the CCP exam

Domain 1 of the CCP exam, CMMC Ecosystem, has one task: "Identify and compare roles/responsibilities/requirements of authorities across the CMMC ecosystem." The roles are defined in one place, 32 CFR Part 170, with two advisory designations defined by The Cyber AB and the training roles described by ISACA. This article goes through every one of them in the rule's own words, with what each may do and may not, who certifies whom, and the current names beside the older ones the exam outline still uses. The roles are also the first free lessons on this site.

The map

The government's roles

The DoD CIO and the CMMC PMO. The rule puts oversight with "The Office of the Department of Defense Chief Information Officer (DoD CIO) Office of the Deputy CIO for Cybersecurity (DoD CIO(CS))", which "provides oversight of the CMMC Program and is responsible for establishing CMMC assessment, accreditation, and training requirements as well as developing and updating CMMC Program policies and implementing guidance." Under it, "The CMMC PMO is responsible for monitoring the CMMC AB's performance of roles assigned in this rule and acting as necessary to address problems pertaining to effective performance." The PMO also keeps "the prerogative to review decisions of the CMMC Accreditation Body".

DCMA DIBCAC. The Defense Contract Management Agency's Defense Industrial Base Cybersecurity Assessment Center is the government's own assessor. Its assessors "Conduct Level 3 certification assessments and upload assessment results into the CMMC instantiation of eMASS", "Issue Certificates of CMMC Status resulting from Level 3 certification assessments", and "Conduct Level 2 certification assessments of the Accreditation Body" and of C3PAOs themselves. A DIBCAC High Assessment can also count toward a Level 2 certification through standards acceptance.

The ecosystem's bodies

The Accreditation Body. "The Accreditation Body is responsible for authorizing and ensuring the accreditation of CMMC Third-Party Assessment Organizations (C3PAOs) in accordance with ISO/IEC 17020:2012(E)", and "At any given point in time, there will be only one Accreditation Body for the DoD CMMC Program." That body is The Cyber AB. The outline still calls it the "CMMC-AB", its former name. It also sets the policies on conflicts of interest, professional conduct and ethics that every ecosystem member must follow, and it hears the final appeal of a Level 2 certification assessment.

C3PAOs. "C3PAOs are organizations that are responsible for conducting Level 2 certification assessments and issuing Certificates of CMMC Status to OSCs based on the results. C3PAOs must be accredited or authorized by the Accreditation Body". Authorized is the interim status, before the ISO/IEC 17020 accreditation is achieved; either status allows a C3PAO to assess. A C3PAO must field an Assessment Team of "at least two people: a Lead CCA, as defined in § 170.11(b)(10), and at least one other CCA. Additional CCAs and CCPs may also participate on an Assessment Team." It must also run a quality assurance function, and "Any individual fulfilling the quality assurance function must be a CCA and cannot be a member of an Assessment Team" for the assessment reviewed.

The CAICO. "The CAICO is responsible for training, testing, authorizing, certifying, and recertifying CMMC assessors, instructors, and related professionals. Only the CAICO may make decisions relating to examination certifications", and there is only one CAICO at a time. Since December 17, 2025 that is ISACA; The Cyber AB operated it before. What changed when ISACA took over covers the transition.

The certified individuals

The CCP. "A CMMC Certified Professional (CCP) completes rigorous training on CMMC and the assessment process to provide advice, consulting, and recommendations to their OSA clients." CCPs "are eligible to become CMMC Certified Assessors and can participate as a CCP on Level 2 certification assessments with CCA oversight where the CCA makes all final determinations." Two things define the role on the exam: a CCP advises, and on an Assessment Team a CCP never makes the final determination.

The CCA. "CCAs, in support of a C3PAO, conduct Level 2 certification assessments of OSCs in accordance with NIST SP 800–171A Jun2018", the assessment processes of the rule and its scoping requirements. "A CCA may conduct Level 2 certification assessments and participate on a C3PAO Assessment Team." A passing CCP exam score is a prerequisite for the CCA. CCP vs CCA compares the two in full.

The Lead CCA. A CCA qualifies as a Lead CCA "by having at least 5 years of cybersecurity experience, 5 years of management experience, 3 years of assessment or audit experience, and at least one foundational qualification aligned to Advanced Proficiency Level of the DoD Cyberspace Workforce Framework's Security Control Assessor (612) Work Role". The CAP describes the job: the Lead CCA "oversees and manages a dedicated Assessment Team on behalf of the C3PAO", "serves as the counterpart to the Affirming Official", and "may oversee multiple Assessment Teams across concurrent CMMC Level 2 certification assessments." The outline's "CMMC Lead Assessor" is this role.

The CCI. "A CMMC Certified Instructor (CCI) teaches CCP, CCA, and CCI candidates and performs CMMC instructional duties." A CCI must hold the assessor certification for what it teaches: "A CCI with a valid CCP certification may instruct CCP candidates", and one with a valid CCA certification may instruct CCA candidates too. ISACA writes the role as CMMC Credentialed Instructor on its pages.

The provisional roles. The rule's Provisional Instructor taught "during the transitional period that ends 18 months after December 16, 2024", which is June 16, 2026. The outline still lists Provisional Assessors and Provisional Instructors, each with a "Timeline for sunsetting"; the rule defines no Provisional Assessor at all. Know that both were transitional, and that the certified roles replaced them.

The contractor's side

OSA and OSC. "Organization Seeking Assessment (OSA) means the entity seeking to undergo a self-assessment or certification assessment for a given information system for the purposes of achieving and maintaining any CMMC Status. The term OSA includes all Organizations Seeking Certification (OSCs)." And "Organization Seeking Certification (OSC) means the entity seeking to undergo a certification assessment for a given information system for the purposes of achieving and maintaining the CMMC Status of Level 2 (C3PAO) or Level 3 (DIBCAC). An OSC is also an OSA." The exam tests the direction: every OSC is an OSA; an organization that only self-assesses is an OSA and not an OSC.

The Affirming Official. "The Affirming Official is the senior level representative from within each Organization Seeking Assessment (OSA) who is responsible for ensuring the OSA's compliance with the CMMC Program requirements and has the authority to affirm the OSA's continuing compliance". The affirmation goes into SPRS after every assessment, after a POA&M closeout, and annually.

The OSC Point of Contact. Not a rule term, but a CAP one: "The individual within or on behalf of the OSC who provides daily coordination and liaison support between the OSC and the Assessment Team", who "does not necessarily have to be an employee of the organization that is being assessed, but rather could be a contractor, consultant, or advisor, such as a CMMC Registered Practitioner (RP)."

The advisory designations

RP, RPA and RPO. The Registered Practitioner, the Registered Practitioner Advanced and the Registered Practitioner Organization are The Cyber AB's designations, not certifications from the CAICO, and the rule does not define them. The Cyber AB's page: "Individuals holding any level of an RP designation can provide CMMC implementation consulting services to assist in identifying gaps and providing mitigation strategies for an OSC preparing for an assessment." The outline's own description is the one to memorize: RPs "are the implementers and consultants, but do not participate in Certified CMMC Assessments." An RPO is the organization that delivers that advisory service through its RPs.

The training roles

APPs and ATPs. ISACA describes the two: Approved Publishing Partners "Develop and publish officially recognized CMMC training content", and Approved Training Providers "Deliver official CMMC courses using CMMC Credentialed Instructors (CCI), providing students with guided training that prepares them for CCP and CCA certification exams." The outline uses the 2022 names, "Licensed Partner Publishers (LPP)" and "Licensed Training Providers (LTP)". The CCP class you must complete before the exam comes from an ATP.

Two more people in the room

The CAP adds two roles the rule does not define. The Authorized Certifying Official is "A designated official employed by the C3PAO and registered with The Cyber AB who is eligible to serve as the issuing authority and signatory for the CMMC Level 2 Certificate of CMMC Status". The quality assurance individual "manages the C3PAO's quality assurance reviews", "also manages a CMMC appeals process that might be initiated by an OSC", "must be a CCA and cannot be a member of an Assessment Team for which they are performing a quality assurance role", and uploads the assessment information into eMASS.

The names, old and new

The four Domain 1 lessons, why CMMC exists, the organizations, the individuals and the Assessment Team, take each role further, with its sources, and are open in full with a free account.