What to read for the CCP exam: the documents

The CCP exam is closed book, and it is written from a known set of documents: a regulation, an assessment process, a handful of guides, two NIST publications, a few contract clauses and the rules that define controlled unclassified information. ISACA's exam content outline names most of them by title, and the Department of War's CMMC page lists the official set. This article is the reading list: every document the exam rests on, in the order to read them, with what each one feeds on the exam, what to read in it, and what to skip.

One measure runs through the list. Every one of the 1,166 questions in this site's bank cites the document its answer rests on, so for each document below you can see how many questions it carries and in which domains. That is a measure of our bank, not of the exam, but the bank is written to the outline's weights, and the pattern it shows is the pattern of the exam: one regulation and one process document carry the weight of the whole thing.

The documents the outline names

Domain 3 of the outline, "CMMC Governance and Source Documents", has a task on exactly this: "Demonstrate understanding of the CMMC source and supplementary documents." Its list of "CMMC Source Documents" is the CMMC Model Overview, the CMMC Level 1 Assessment Guide, the CMMC Level 2 Assessment Guide, the CMMC Level 1 Scoping Guidance, the CMMC Level 2 Scoping Guidance, the CMMC Assessment Process (CAP), the CMMC Glossary and the CMMC Artifact Hashing Tool User Guide. The same domain's other tasks name the regulations behind them: Part 32 of the CFR, the DFARS, clause 252.204-7012, NIST SP 800-171, FAR 52.204-21, FAR 4.1901, Executive Order 13556, 32 CFR Part 2002, DoDI 5200.48 and the NARA CUI Registry and marking handbook.

The Department's own documentation page lists what it publishes: 32 CFR Part 170, the DFARS rule, the Model Overview, the Level 1 Scoping Guidance, the "CMMC Level 1 Self-Assessment Guide", the Level 2 Scoping Guidance and the Level 2 Assessment Guide, and points to the DFARS clauses, the DoD CUI Program site, SPRS and NIST SP 800-171 and 800-171A as external resources. The CAP and the Code of Professional Conduct are The Cyber AB's documents, not the Department's.

Page counts are of the editions linked under Sources, as the publishers print them.

1. 32 CFR Part 170: read all of it, in order

The regulation is the program. It is 41 pages in the Code of Federal Regulations, in four subparts: general information, with the definitions; government roles; the CMMC ecosystem, one section each for the Accreditation Body, C3PAOs, the CAICO, assessors, instructors and professionals; and the key elements, from the model and the four levels through scoping, plans of action and milestones, affirmation, subcontractors and the scoring methodology. More than half of our questions cite it, and no domain is without it: it carries 104 of our Domain 1 questions, 62 of Domain 2, 104 of Domain 3, 177 of Domain 4, 106 of Domain 5 and 69 of Domain 6.

Read it from the first section to the last, then read the definitions a second time after you have read the rest, because every defined term is used in its defined sense. The sections to know cold are the ones the exam turns into scenarios: the three assessment types for Level 2 and Level 3 and what each status requires, scoping, what may go on a plan of action and milestones, affirmation, the subcontractor flowdown and the scoring methodology. The appendix is a list of guidance documents; it needs a glance, not a study.

The rule also settles which editions of everything else you read. It incorporates by reference "SP 800–171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, Revision 2, February 2020 (includes updates as of January 28, 2021)" and "SP 800–171A, Assessing Security Requirements for Controlled Unclassified Information, June 2018", and it draws the Level 3 requirements from NIST SP 800-172 of February 2021. Those are the exam's editions.

2. The CMMC Assessment Process: read all of it

The CAP, version 2.0 of December 16, 2024, is 29 pages from The Cyber AB. It describes a Level 2 certification assessment from the request through four phases: preliminary proceedings, Phase 1, the pre-assessment; Phase 2, assessing conformity to the security requirements; Phase 3, completing and reporting results; and Phase 4, issuing the certificate and closing out the POA&M. Domain 5 of the exam, a quarter of it, is this document: 106 of our 170 Domain 5 questions cite it, and it reaches into every other domain too, 236 citations in all.

Read it twice. The first time, follow the sequence: what happens in each phase, who does it and what it produces. The second time, read for the rules inside the sequence: who may be on the Assessment Team, what the Lead CCA decides, how evidence is sampled, how a NOT MET finding is re-evaluated, what the Out-Brief covers, how an appeal runs and what the C3PAO uploads. The CAP names the documents it rests on, and its own disclaimer says that where it and the Department's or NIST's documents disagree, the reader "should adhere to the DoD and/or NIST documentation."

Skip the 2022 draft. The CAP's revision history records a "Pre-Decisional Draft" of August 2022, and its footnote explains that "A DRAFT CAP with an internal developmental version number 5.6.1 was provided for training purposes only during the summer of 2022." Courses and question banks still built on that draft describe a process that was never in force.

3. The Assessment Guides: front matter in full, then every Level 1 requirement

The two Assessment Guides share a structure. Each opens with an introduction, the assessment scope, the CMMC-custom terms, the assessment criteria and methodology, and the assessment findings, then describes every requirement in the same shape: the requirement's statement, its assessment objectives, its potential assessment methods and objects, a discussion from NIST, a further discussion, an example and potential assessment considerations.

Read the front matter of both guides in full. It is about a dozen pages each, and it holds the methods (examine, interview, test), the objects, the findings (MET, NOT MET, NOT APPLICABLE) and the rule that one NOT MET objective fails the requirement. Domain 4's largest task, evaluating implementation, is built on those pages.

Then read every Level 1 requirement in the Level 1 guide, all fifteen, in full. The outline lists the Level 1 practices one by one by their NIST numbers, and 302 of our 436 Domain 4 questions cite the Level 1 guide. The guide numbers the requirements after the FAR clause's safeguards (AC.L1-b.1.i), while the outline numbers them after NIST (AC.L1-3.1.1); the rule's mapping table connects the two, and you need both forms.

For the Level 2 guide, read the front matter and then use the requirement descriptions as a reference. At 276 pages for 110 requirements, it is not a book to read cover to cover before the exam; it is the book to open for any requirement a question turns on, and for the shape of an objective, a method and a finding at Level 2.

4. The Scoping Guides: read both, short as they are

The Level 1 Scoping Guide is 8 pages and the Level 2 Scoping Guide is 16. Together they are Domain 6, 15% of the exam: 29 and 40 of our 110 Domain 6 questions cite them. Read both in full and learn the asset categories as tables: at Level 1, which assets are in scope, out of scope, or specialized; at Level 2, the five categories, what each requires in the system security plan, and how each is assessed. The Level 2 guide's treatment of external service providers, cloud providers and the separation of assets is where the scenario questions come from.

5. The Code of Professional Conduct: read it all

Version 2.0 of The Cyber AB's Code, dated December 2024, is 22 pages in four articles: purpose and scope, the guiding principles, conflicts of interest and enforcement. The guiding principles are professionalism, impartiality, confidentiality, information integrity, lawful and ethical behavior, equal opportunity, proper use of CMMC methods, and proper use of technology and artificial intelligence. Domain 2 is 5% of the exam, and 72 of our 99 Domain 2 questions cite the Code, but conflicts of interest reach into Domain 1 and Domain 5 as well. Read every practice under every principle; the questions describe a situation and ask which practice it breaches.

6. NIST SP 800-171 Revision 2 and 800-171A: the fundamentals, then the requirements as a reference

NIST SP 800-171 Revision 2 is 114 pages. Its first two chapters, the introduction and the fundamentals, explain where the requirements come from, the difference between basic and derived requirements, and how the moderate baseline was tailored; read them in full. Chapter three holds the 110 requirements with NIST's discussion under each, which the Level 2 guide reproduces. Appendix D maps the requirements to the controls they derive from, and Appendix E is the tailoring criteria; glance at both, read neither.

NIST SP 800-171A, June 2018, is 93 pages. Its second chapter, the fundamentals, defines the assessment methods, the assessment objects, and the depth and coverage attributes, and Appendix D describes the methods in full; read those. Chapter three is the assessment procedures for every requirement, the objectives the Level 2 guide reproduces; use it as a reference.

Do not study Revision 3 of either publication. NIST has published it, and the rule has not adopted it. The question style on this point is a trap worth knowing.

7. The contract clauses: short, and read in full

FAR 52.204-21 is a single page: the fifteen basic safeguarding requirements that are CMMC Level 1, in paragraph form. FAR 4.1901 is the definition of Federal Contract Information. DFARS 252.204-7012 is four pages: the definitions, including covered defense information and the technical data definition it takes from 252.227-7013, the obligation to implement NIST SP 800-171, the cloud provisions and the incident reporting requirement. The 2025 acquisition rule, DFARS Case 2019-D041, is the rule that put CMMC into contracts, with provision 252.204-7019, clause 252.204-7020 and clause 252.204-7021; read the clauses' text and the rule's effective date, November 10, 2025, and treat the rest of its preamble as background.

These feed Domain 1 and Domain 3: 21 of our Domain 3 questions cite clause 7012 and 27 cite the acquisition rule.

One note on numbers, added October 2, 2026. Under the FAR overhaul and DoD Class Deviation 2026-O0025, effective February 1, 2026, FAR 52.204-21 is printed at 52.240-93, DFARS subparts 204.73 and 204.75 are now 240.370 and 240.371, clause 252.204-7020 is replaced by 252.240-7997 and provision 7019 is no longer prescribed; 7012 and 7021 are unchanged. The exam's documents keep the old numbers. 52.204-21 is now 52.240-93 has the detail.

8. The CUI documents: the rule and the registry

Executive Order 13556 created the CUI Program; 32 CFR Part 2002 is its implementing rule, 21 pages, and 83 of our 220 Domain 3 questions cite it. Read the definitions, the sections on designating, marking and decontrolling, and the parts that bind a contractor that handles CUI on an agency's behalf. The outline also names DoDI 5200.48, the Department's own CUI instruction, and the NARA CUI Registry with its marking handbook; know what each is for, and know the registry's category markings, Export Controlled and the Department's Naval Nuclear Propulsion Information among them, which the outline singles out.

9. Background you will be glad you read

• The preamble to the program rule, 89 FR 83092 of October 15, 2024, is the Department's response to the comments on the proposed rule. It explains why the rule says what it says: why CCPs work under a CCA's oversight, why POA&Ms are limited, why Level 3 is scored separately. It is 146 pages in the Federal Register, rule included, and 149 of our questions cite it, 69 of them in Domain 3. Read the responses on the topics you find hard rather than the whole document.
• The Model Overview, 46 pages, describes the model's levels and domains and carries the matrix that maps the Level 1 requirements to their Level 2 counterparts; 54 of our Domain 4 questions cite it. Read the chapters on the model and the levels.
• The Hashing Guide, 14 pages, is the procedure for hashing assessment artifacts so that the assessor retains hash values rather than the artifacts; it turns up in Domain 2 and Domain 5.
• ISACA's 2026 candidate guide is not a source for the content, but it is the source for the exam itself: the format, the scoring scale, the retake rules and the outline in Appendix A. How hard is the CCP exam is built from it.

What to skip

• NIST SP 800-171 Revision 3 and 800-171A Revision 3. Not the rule's editions.
• The CAP's 2022 draft, version 1.0 or "5.6.1". Superseded by version 2.0.
• CMMC 1.0 material: five levels, maturity processes, "ML" numbering. The rule's model has three levels and no process maturity requirements.
• The 2022 CCP blueprint from The Cyber AB. ISACA's 2026 candidate guide supersedes it; the domains are the same, the passing score and the prerequisites are not.
• NIST SP 800-172 in full. The rule draws 24 Level 3 requirements from it, and the outline names neither the publication nor Level 3's requirements; know that it exists and what it is for.

A reading order

Read the rule first, because everything else uses its terms. Then the CAP, then the front matter of both Assessment Guides, then the fifteen Level 1 requirements, then both Scoping Guides, then the Code. That is about 180 pages, and every domain of the exam draws on it. Add the NIST fundamentals and the clauses in the second half of your study, and keep the Level 2 guide, the preamble and the registry open as references while you practice.

The 49 lessons on this site are written from these documents in this order, and every lesson lists the sources it rests on. The Domain 1 lessons are open in full with a free account, and sample questions show how the exam asks about what you have read.