How hard is the CCP exam? ISACA does not publish a pass rate, so there is no official figure to point to, and any rate you see quoted is not ISACA's. What ISACA does publish, in its 2026 candidate guide, tells you exactly where the difficulty lies: the pace, the question style, the scenarios, and the size of the document set behind six domains. This article takes each in turn, then sets out an eight-week study plan weighted the way the exam is.
The CCP exam in numbers
| What | The CCP exam |
|---|---|
| Questions | 170, multiple choice |
| Time | 3.5 hours (210 minutes) |
| Time per question | about 74 seconds |
| Format | Closed book, one best answer from four options |
| Passing score | 450 on a scale of 200 to 800 |
| Pass rate | Not published |
What makes the CCP exam hard
The pace
170 questions in 210 minutes leaves about 74 seconds per question, with no time added for reading long scenarios. Breaks do not help: the guide allows two breaks, no longer than ten minutes each, with your proctor's permission, and "the exam will be paused, but the timer will not stop."
One best answer
Every question has a stem and four options, and "all questions are designed with one best answer." The guide warns that a question "may require you to choose the answer based on a qualifier, such as MOST likely or BEST." That means more than one option can look right, and the question turns on which is best under the CMMC documents.
Scenarios, not recall
ISACA says its questions measure "practical knowledge and the application of general concepts and standards." The exam content outline in the guide bears that out. Several tasks begin "Given a scenario":
- apply the appropriate CMMC source documents to evaluate the implementation of CMMC practices (domain 4);
- determine the appropriate phases and steps to prepare, conduct or report on a Level 2 assessment (domain 5);
- analyze an organization's environment to generate an appropriate scope for FCI assets (domain 6).
Others ask you to analyze the adequacy and sufficiency of evidence, or to choose the CCP's role in each phase of an assessment. Knowing a definition is rarely enough; you have to apply it.
The document set
It is a closed-book exam over a large library. Domain 3 alone asks you to understand the CMMC source documents: the CMMC Model Overview, the Level 1 and Level 2 Assessment Guides, the Level 1 and Level 2 Scoping Guidance, the CMMC Assessment Process (CAP), the CMMC Glossary and the CMMC Artifact Hashing Tool User Guide. It adds the CUI Registries kept by NARA and by DoD, DoDI 5200.48 and 32 CFR Part 2002. Behind them all sits the CMMC rule, 32 CFR Part 170, and the contract clauses it builds on.
The guide names the Department of War as "the authoritative source for CMMC documentation." Our lessons cite those documents section by section; the CMMC document set is a good map of what exists and which document carries the force of law.
The weighting
Two domains carry most of the weight:
| Domain | Weight |
|---|---|
| 1. CMMC Ecosystem | 5% |
| 2. CMMC-AB Code of Professional Conduct (Ethics) | 5% |
| 3. CMMC Governance and Source Documents | 15% |
| 4. CMMC Model Construct and Implementation Evaluation | 35% |
| 5. CMMC Assessment Process (CAP) | 25% |
| 6. Scoping | 15% |
Domains 4 and 5 are 60% of the exam between them. Domain 4 covers the model, its practices, the assessment criteria and methods, and evidence; the outline says that "at a minimum CCP candidate must be evaluated on CMMC L1 Practices during CCP exam." Domain 5 follows the four phases of an assessment and the CCP's role in each.
How the exam is scored
The scoring rules shape how you should prepare:
- Scores are scaled from 200 to 800. "A score of 800 represents a perfect score with all questions answered correctly", 200 is the lowest possible, and you need 450 or higher, which "represents the minimum standard of knowledge."
- There is no passing score per domain. Scores are "based on the total number of exam items answered correctly, regardless of domain", and domain results are "for informational purposes only."
- Some questions do not count. ISACA exams include pretest items that are not used to calculate scores. ISACA does not say how many there are or which ones they are, so treat all 170 as counting.
- Wrong answers cost nothing. "There are no penalties for incorrect answers," so the guide's advice is not to leave any question blank.
Because the pass is decided on the total, a weak domain can be carried by strong ones, but only in proportion to its weight: domain 4 carries seven times the weight of domain 1. The CCP passing score explains the scale in more detail.
What the questions look like
Here is a question from our free first domain, in the exam's format:
Three of the four options are real CMMC documents, and all of them matter on the exam; the question tests which one binds. That is the pattern across the bank. The course's practice questions, in the app, each carry a full explanation and citation, and the first domain's are free with an account.
An eight-week CCP study plan, weighted by the blueprint
This is our plan, not ISACA's. It gives each domain time in proportion to its weight, puts the heaviest domains in the middle when you are most productive, and leaves the last two weeks for timed practice. Adjust the length to your exam date; the proportions are what matter.
| Week | Focus | Weight covered |
|---|---|---|
| 1 | Domains 1 and 2: the ecosystem, the roles and the Code of Professional Conduct. Take a diagnostic to find your baseline. | 10% |
| 2 | Domain 3: governance and source documents, FCI and CUI, and the CUI registries | 15% |
| 3 | Domain 4, part one: the model's architecture and levels, and the Level 1 practices | 35% |
| 4 | Domain 4, part two: assessment criteria and methods, and evidence adequacy and sufficiency | |
| 5 | Domain 5, part one: the CAP's phases 1 and 2, planning and conducting an assessment | 25% |
| 6 | Domain 5, part two: phases 3 and 4, reporting and POA&M close-out; then domain 6, scoping | 15% |
| 7 | Mixed practice across all domains by weight, timed at about 74 seconds a question; review every wrong answer against its source | |
| 8 | Two full-length timed mocks of 170 questions in 210 minutes, with a review between them |
Three habits make the plan work:
- Learn from the source, not the summary. Read each answer's explanation and the document it cites. The exam's scenarios test the documents, and the documents are where the distinctions live.
- Practice untimed first, then timed. Early on, accuracy matters more than speed. From week 7, hold yourself to the exam's pace.
- Let your weakest heavily weighted area lead. A gap in domain 4 can cost seven times as many questions as a gap in domain 1.
Exam-day rules that cost attempts
A good plan can still be undone on the day. The guide's rules are strict:
- Arrive early. For a test center, plan to arrive at least 30 minutes before the start. More than 15 minutes late forfeits the registration fee.
- Bring nothing. Prohibited items include study materials, paper and notes, calculators, multiple monitors, phones, tablets, smart watches or glasses, headphones, bags, and food or drink, "this includes water".
- Remote proctoring is strict too. No one else may be in the room, you may not step away without the proctor's permission, and the guide says "any form of cheating will not be tolerated and will result in a voided exam without a refund." Run the compatibility check on your device before exam day.
- Know the consequences. Violating the rules can mean dismissal, a voided exam, revocation of ISACA membership and certifications, and a ban from ISACA exams.
If you do not pass
You have four attempts within a rolling 12 months. The waits are 30 days after the first attempt, then 90 days after the second and 90 days after the third, and each attempt costs the full registration fee. Use your domain results, which ISACA reports for information only, to decide where your next weeks go. What the CCP exam costs shows how quickly retakes add up.
Start preparing
The first domain, CMMC Ecosystem, is open in full with a free account, with its lessons, questions and flashcards, plus a diagnostic and a study plan from your exam date. The first domain's questions are free with a free account, and the course holds 1,166. Timed mocks in the exam's format are part of full access.
By QualExam editorial. Written against the certifying body’s published documents, pinned by hash so a revised edition shows up as a change.