What changed when ISACA took over the CCP exam

Until December 2025, CMMC certification for individuals ran through the CMMC Assessor and Instructor Certification Organization (CAICO) operated by The Cyber AB. ISACA now holds that role. If you started preparing under the old system, or you are reading a guide written before the change, some of the figures you have seen are out of date. Here is what changed for CCP candidates, what stayed the same, and what to do if you trained or certified under The Cyber AB.

The transition in three dates

• December 17, 2025. ISACA announced that it had been authorized as "the new and exclusive CMMC Assessor and Instructor Certification Organization (CAICO)", responsible for the training, examination and professional certification of CMMC professionals, assessors and instructors. The credentials it administers are the CMMC Certified Professional (CCP), the CMMC Certified Assessor (CCA) and Lead CCA, and the CMMC Certified Instructor (CCI). ISACA's announcement added that "the full transition of services will occur by 1 April 2026."
• April 1, 2026. The date set for the full transition.
• April 20, 2026. ISACA reported that "CAICO services fully transitioned to ISACA this month."

The change came as CMMC itself took effect in contracts. The DFARS rule that brings CMMC into defense contracts "is effective November 10, 2025", and ISACA describes a phased implementation "toward full implementation by November 2028."

Who does what now

The Cyber AB did not leave the program. ISACA's press release notes that "the CAICO was operated by The Cyber AB, which remains the official CMMC accreditation body," and ISACA's own answers say "CyberAB will continue to run point on Tier 3 Investigations for CCPs and CCAs." ISACA was authorized as the CAICO by The Cyber AB.

What changed for CCP candidates

The clearest way to see the change is to set The Cyber AB's 2022 documents beside ISACA's 2026 candidate guide:

Three of those changes catch people out:

The passing score is 450, not 500. The 2022 blueprint's figure is still quoted in older guides. ISACA reports scores on a 200 to 800 scale, and "candidates must receive a score of 450 or higher to pass the exam." The CCP passing score explains the scale.

The exam costs more, and renewal costs less. ISACA says so plainly: "Exam prices have increased, but annual renewal fees were lowered to offset the cost." Its worked example, for someone holding both the CCP and the CCA, puts three-year total costs at $3,175 under the previous pricing, $2,280 through ISACA, and $2,105 with ISACA membership. What the CCP exam costs lists every current fee.

The US$200 now comes after the exam. Under The Cyber AB, the US$200 was part of the application that qualified you for the exam. Under ISACA, you pay the US$200 application processing fee after you pass, when you apply for certification, and the guide gives you "one (1) year from passing the exam to apply."

The 2026 guide sets out the rest of the journey: registration with a six-month eligibility window, four attempts within a rolling 12 months with waits of 30, 90 and 90 days, and a CPE Policy of 120 hours per three-year period. How to become a CCP takes them step by step.

What did not change

For anyone who studied under the old system, the good news is how much of the exam itself is the same:

• The format. 170 multiple-choice questions in 3.5 hours, not open book, in both the 2022 blueprint and the 2026 guide.
• The domains and their weights. The six domains are the same, with the same weights: CMMC Ecosystem 5%, the Code of Professional Conduct 5%, Governance and Source Documents 15%, Model Construct and Implementation Evaluation 35%, the CMMC Assessment Process 25% and Scoping 15%.
• The education and experience requirement. A cyber or IT degree, 2+ years of related experience or education, or 2+ years of equivalent experience including military, with the class.
• The CCP's place in the path. In both documents, a passing score on the CCP exam is a prerequisite for the CCA and CCI certifications.

One change since then came from the Department rather than from ISACA. On July 13, 2026, the Department of War suspended the move to Phase 2 of CMMC and held later implementation milestones in abeyance, so that program offices may require only Level 1 (Self) or Level 2 (Self) for now. The exam, its fees and ISACA's role did not change with it. Is the CCP worth it after the Phase 2 pause? covers what the memorandum stopped and what it left in place.

If you trained or certified under The Cyber AB

ISACA's transition notes answer the common questions:

• Your account. "An account was set up for you using the email address associated with your CyberAB account." To use it, log in and reset your password. If you used different email addresses with ISACA and The Cyber AB and now have two accounts, ISACA's support site can reconcile them.
• Your CPE. A CPE activity that fulfills both an ISACA certification and the CCP or CCA can count toward both.
• Your background check. It still runs through The Cyber AB. It starts after you have completed CCP training, passed the exam and applied for certification; ISACA validates your experience, then sends your information to The Cyber AB.
• Your exam. Both in-person and remote options are available.

Where outdated figures still circulate

If a guide or course quotes any of these, check its date:

• A passing score of 500. That is the superseded 2022 blueprint; the current figure is 450.
• A $275 exam fee. That is the 2022 fee; ISACA's is US$575 or US$760.
• Licensed Training Provider. The 2026 guide says Approved Training Provider.
• Five years to apply. ISACA's own CCP web page says five years, but its controlled candidate guide says one. Plan around the guide.
• CAP version 5.x. The current CMMC Assessment Process is version 2.0, dated December 16, 2024. The CAP explains the old number: "A DRAFT CAP with an internal developmental version number 5.6.1 was provided for training purposes only during the summer of 2022." The CAP and its four phases is built on version 2.0.

Every lesson and question on this site is written against the 2026 candidate guide and the current CMMC documents, and each one names its source. The first domain is open in full with a free account, its practice questions included.