How to become a CMMC Certified Professional (CCP)

Becoming a CMMC Certified Professional (CCP) takes more than passing an exam. ISACA's 2026 candidate guide sets out the requirements for certification, the CMMC rule adds a background investigation and a code of conduct, and one deadline is shorter than many summaries say. This guide takes each step in the order you will meet it, with its fee, its deadline and the document it comes from.

The steps at a glance

What a CCP is, and what the certification lets you do

The CMMC rule describes the CCP in one paragraph, 32 CFR 170.13. A CCP "completes rigorous training on CMMC and the assessment process to provide advice, consulting, and recommendations to their OSA clients", where an OSA is an organization seeking assessment. CCPs "are eligible to become CMMC Certified Assessors and can participate as a CCP on Level 2 certification assessments with CCA oversight where the CCA makes all final determinations."

ISACA's guide puts the same thing in career terms. The CCP is "the foundational certification for anyone seeking to work within the implementation and assessment ecosystem" of the Department of War's CMMC program. It validates that you are ready to help organizations build assessment-ready cybersecurity programs, or to take part on a CMMC Assessment Team during official assessments. A passing score on the CCP exam is also a prerequisite for the CMMC Certified Assessor (CCA) and CMMC Certified Instructor (CCI) certifications.

In short, a CCP advises clients and can join a Level 2 certification assessment, and the CCA on that team makes the final determinations. If you are weighing the two, CCP vs CCA compares them side by side, and the lesson on the individuals in the CMMC ecosystem covers every role the exam asks about.

One date to know as you plan. On July 13, 2026, the Department of War suspended the move to Phase 2 of CMMC, the phase that would have required Level 2 certification assessments by C3PAOs as a condition of award from November 10, 2026. Self-assessments, affirmations and the DFARS clause continue, the rule and the exam are unchanged, and a CCP's advisory role continues; the Assessment Team role waits for certification assessments to resume. Is the CCP worth it after the Phase 2 pause? sets out what the Department's memorandum did and did not change.

Who the CCP is for

The guide names eight audiences for the exam:

• employees of organizations seeking CMMC certification (OSCs);
• information technology (IT) and cybersecurity professionals;
• regulatory compliance officers;
• legal and contract compliance professionals;
• management professionals;
• cybersecurity and technology consultants;
• federal employees;
• candidate CMMC Assessment Team members.

If your work touches a defense contractor's CMMC obligations, whether preparing for an assessment, advising on one or taking part in one, you are in one of these groups.

Step 1: Check that you are eligible

The exam's prerequisites, in Appendix A of the guide, are one education or experience requirement plus the class:

• a college degree in a cyber or information technical field, or 2+ years of related experience or education; or
• 2+ years of equivalent experience, including military, in a cyber, information technology or assessment field; and
• the Certified CMMC Professional class from an Approved Training Provider (ATP).

Your experience is checked later. When you apply for certification, you submit an application "to demonstrate the experience requirements", and ISACA validates it before your details go on to the background investigation.

Step 2: Complete the CCP class

The class is mandatory, and the guide names it in two places. Appendix A lists the "Certified CMMC Professional Class offered by an Approved Training Provider (ATP)" as an exam prerequisite, and the certification steps begin with "mandatory training from an approved training provider or ISACA."

The guide does not set a price for the class. Providers set their own, so treat any figure you see quoted as one provider's price rather than a program fee.

Step 3: Register for the exam

Registration is online with ISACA, and it is continuous: you can register at any time and schedule a testing appointment as early as 48 hours after you pay. What to know before you pay:

• The fee. US$575 for ISACA members and US$760 for nonmembers, based on your membership status when you register. It is nonrefundable and nontransferable.
• Your name. Create your ISACA account in the name on the government-issued ID you will show on exam day.
• The six-month window. From the date you register, you have six months to take the exam. If you need more time, a six-month extension costs US$75. There is a maximum of one extension, and an exam that is already scheduled must be canceled at least 48 hours before its date to extend.
• What forfeits the fee. Not testing within the six months, missing the appointment, or arriving more than 15 minutes late. Each forfeits both the eligibility and the registration fee.

The exam is computer-based, at a PSI testing center or remotely proctored. What the CCP exam costs adds up every fee, retakes included.

Step 4: Pass the exam

The CCP exam is 170 multiple-choice questions in 3.5 hours (210 minutes), in English, and it is not open book. The passing score is 450 on a scaled range of 200 to 800. The questions follow six domains with fixed weights:

Scoring is based on the total number of questions answered correctly, regardless of domain, so there is no passing score per domain. How hard is the CCP exam covers what makes it demanding and how to prepare, and the course holds 1,166 practice questions in the exam's format, the first domain's free with a free account.

Your result, and retakes

A preliminary pass or fail appears on screen as soon as you finish. The official score is emailed and posted to your ISACA account within 10 working days, and if you passed, it tells you how to apply for certification. ISACA does not provide question-level results.

If you do not pass, you have four attempts within a rolling 12-month period. You wait 30 days after the first attempt, then 90 days after the second and 90 days after the third, and each attempt needs the full registration fee. The CCP passing score explains how the scaled score works.

Step 5: Apply for certification within one year

Passing the exam is "only one part of becoming certified," the guide says. To become certified, you:

1. complete the mandatory training;
2. pass the exam;
3. pay the US$200 application processing fee;
4. submit an application that demonstrates the experience requirements;
5. have a Tier 3 determination from the Department of War;
6. adhere to ISACA's Code of Professional Ethics;
7. adhere to the Continuing Professional Education (CPE) Policy.

The guide's list has one more item, a DoD 8140.3 proficiency level, which applies to the CCA only.

The deadline is one year, not five. The guide says: "Candidates have one (1) year from passing the exam to apply for certification." ISACA's CCP web page says five years. When a web page and a controlled document disagree, plan around the controlled document, which is the guide.

Two sets of rules bind you once you apply. ISACA's Code of Professional Ethics is a condition of certification, and failing to comply "can result in an investigation and disciplinary measures, including but not limited to exam score nullification or certification revocation." The CMMC rule also requires CCPs to comply with the Accreditation Body's policies on conflict of interest, its Code of Professional Conduct and ethics (32 CFR 170.13(b)(2)). That code is 5% of the exam, and the Code of Professional Conduct lessons cover it.

The CCP and CCA certifications are accredited by the ANSI National Accreditation Board (ANAB) under ISO/IEC 17024:2012, the standard for bodies that certify persons.

Step 6: Complete the Tier 3 background investigation

The CMMC rule requires every CCP to "complete a Tier 3 background investigation resulting in a determination of national security eligibility" (32 CFR 170.13(b)(3)). Three things about it surprise people:

• It is not a security clearance. The rule says the investigation "will not result in a security clearance and is not being executed for the purpose of government employment."
• It starts with the SF 86, the Questionnaire for National Security Positions. The positions are designated noncritical sensitive, with a risk designation of "Moderate Risk".
• The Cyber AB runs it, after you apply. ISACA's transition notes say the background check starts once you have completed CCP training, passed the exam and applied for certification. ISACA validates your experience, then sends your information to the Cyber AB so the check can start.

If you are not eligible for a Tier 3 investigation, the rule allows you to meet an equivalent, which DoD determines for use in the CMMC program only. Neither the rule nor the guide publishes how long the investigation takes or what it costs.

Step 7: Keep the certification

A CCP certification "is valid for 3 years from the date of issuance" (32 CFR 170.13(b)(1)). To keep it, ISACA's CPE Policy asks for:

• 120 CPE hours per three-year period. At least 90 must align with the CCP exam content outline, and six of those 90 must relate to the CMMC process. Up to 30 can be other professional development, such as leadership or soft skills.
• At least two hours on the CMMC rules, focused on current requirements, guidance and official interpretations.
• An annual maintenance fee, invoiced by ISACA each year. The policy does not state the amount.
• Payment and CPE reporting by December 31. Your first reporting year starts on January 1 after you are certified. Hours earned between your certification date and that December 31 can count toward your first period, but you do not have to report them.
• Random audits. Each year ISACA audits a sample of certification holders, who must provide written evidence of the activities they reported.

One detail before you print business cards: the policy does not allow individuals to use the ISACA certification logo, but you can put the acronym after your name.

How long does it take?

Neither ISACA nor the rule publishes a typical timeline, but the fixed intervals are these:

• 48 hours: the earliest you can test after paying;
• six months: your window to take the exam, or twelve with the one extension;
• 10 working days: the longest you wait for the official score;
• one year: your window to apply after passing.

The class length is set by each provider, and the background investigation has no published duration.

Mistakes that cost candidates money

• Registering before you are ready. The six-month clock starts at registration, and the fee is nonrefundable.
• Arriving late. More than 15 minutes late forfeits the fee.
• A name that does not match your ID. Set up your ISACA account in the name on the ID you will bring.
• Trusting the five-year figure. Apply within one year of passing, as the guide says.
• Treating a retake as cheap. Each attempt is a full registration fee, after a 30- or 90-day wait.

Where to start

The first domain, CMMC Ecosystem, is open in full with a free account, and its lessons read in the app. A good first one is why CMMC exists. When you are ready to test yourself, see how practice works, or what full access costs.