- Maps to CCP Domain 1, CMMC Ecosystem (5%).
- Explain the roles of the DoW, the CAICO, the Cyber AB, C3PAOs, CCPs, CCAs, and organizations seeking assessment.
- Compare what a CCP can and cannot do on a Level 2 assessment team.
- Trace the career path from CCP to CCA and Lead CCA.
CMMC Certification Training
CMMC Certified Professional™ (CCP™) Certification Training Course
Learn how CMMC works from the inside: the rules, the roles, the evidence, and the assessment process. Accumentum prepares you for the CMMC Certified Professional (CCP) exam, the first credential on the path to CMMC Certified Assessor.
Course focus: The six CCP exam domains, from the CMMC ecosystem and Code of Professional Conduct to Level 1 and Level 2 practice evaluation, the CMMC Assessment Process, and scoping, for people entering defense industrial base cyber compliance.
Course Overview
Learn the CMMC ecosystem, its source documents, and how assessments actually run.
The CMMC Certified Professional™ (CCP™) Certification Training Course with Accumentum prepares you for the CCP exam that ISACA now administers as the CMMC Assessor and Instructor Certification Organization (CAICO) for the Department of War. ISACA calls CCP the foundational certification for anyone who wants to work in CMMC implementation or assessment.
CCP is also the required first step toward CMMC Certified Assessor (CCA). A certified CCP with a favorable Tier 3 determination can sit on a CMMC Level 2 assessment team, but final determinations are made by a CCA. If you want to lead assessments later, this is where you start.
The eight modules follow ISACA’s six CCP domains: CMMC Ecosystem (5%), CMMC-AB Code of Professional Conduct (5%), CMMC Governance and Source Documents (15%), CMMC Model Construct and Implementation Evaluation (35%), CMMC Assessment Process (25%), and Scoping (15%).
Accumentum is not a CMMC Approved Training Provider (ATP). ISACA requires every CCP candidate to complete mandatory CCP training through an ATP listed on the CyberAB Marketplace. This course is exam preparation that sits alongside that training. It does not replace it.
Next step: CMMC Certified Assessor (CCA). When you hold an active CCP and meet the experience and 8140 requirements, the CCA course prepares you for formal Level 2 assessment work.
Course Objectives
Build CCP exam readiness and practical CMMC knowledge.
01
Know the ecosystem
Explain who does what in CMMC: the DoW, the CAICO, C3PAOs, assessors, practitioners, and the organizations seeking assessment.
02
Work from the source documents
Use the CMMC rule, the assessment guides, and NIST SP 800-171 to decide what a practice requires and what evidence shows it.
03
Evaluate practice implementation
Judge whether evidence is adequate and sufficient for Level 1 and Level 2 practices, the way an assessment team member would.
04
Scope and support an assessment
Identify FCI and CUI assets, set an assessment scope, and support each phase of the CMMC Assessment Process.
Who Should Attend
- IT and security staff at defense industrial base companies preparing for CMMC.
- Compliance and GRC leads who run CMMC programs for their organization.
- Consultants who advise defense contractors on CMMC readiness.
- Veterans and early-career professionals moving into DIB cyber compliance, and anyone planning to become a CCA.
Prerequisites
- ISACA’s CCP candidate guide lists no experience requirement for CCP. The Cyber AB has recommended a cyber or IT degree, or two or more years of related experience including military, plus CompTIA A+ level knowledge.
- To be certified, ISACA requires mandatory CCP training through an Approved Training Provider, a passing exam score, the application, and a favorably adjudicated Tier 3 background investigation by the DoW.
- The Tier 3 investigation is started with the SF 86. Under 32 CFR 170.13 it does not result in a security clearance.
- Training does not replace ISACA’s certification requirements. Confirm current rules on isaca.org before you register.
Pathway Map
The CCP training course covers all six CCP domains across eight modules.
Every module opens with the exam domain it maps to, so you can see how the pieces fit together across the course.
Course Content
- Maps to CCP Domain 2, CMMC-AB Code of Professional Conduct (Ethics) (5%).
- Apply the guiding principles of the Code of Professional Conduct to real situations.
- Recognize conflicts of interest and how to handle them.
- Protect information about an organization seeking certification that you learn during an assessment.
- Maps to CCP Domain 3, CMMC Governance and Source Documents (15%).
- Tell Federal Contract Information (FCI) apart from Controlled Unclassified Information (CUI).
- Identify who is responsible for marking, handling, and protecting FCI and CUI.
- Work through the CMMC rule, DFARS clauses, NIST SP 800-171, and the CMMC assessment and scoping guides.
- Maps to CCP Domain 4, CMMC Model Construct and Implementation Evaluation (35%).
- Work through the 15 Level 1 security requirements in FAR clause 52.204-21.
- Apply assessment objectives and methods (examine, interview, test) to each practice.
- Decide whether evidence is adequate and sufficient.
- Maps to CCP Domain 4, CMMC Model Construct and Implementation Evaluation (35%).
- Map Level 2 to the 110 security requirements in NIST SP 800-171 Revision 2.
- Evaluate implementation evidence for access control, configuration, incident response, and other families.
- Spot common evidence gaps before an assessment team does.
- Maps to CCP Domain 5, CMMC Assessment Process (CAP) (25%).
- Walk through the four CAP phases: plan and prepare, conduct, report, and evaluate outstanding POA&M items.
- Understand the CCP role as an assessment team member in each phase.
- Practice scenario questions on where a step belongs in a Level 2 assessment.
- Maps to CCP Domain 5, CMMC Assessment Process (CAP) (25%).
- Support the preparation of assessment results.
- Understand when a plan of action and milestones is allowed and how closeout is evaluated.
- Keep records and documentation in line with program rules.
- Maps to CCP Domain 6, Scoping (15%).
- Apply high-level CMMC scoping as described in the assessment process.
- Categorize assets in a given environment and build an appropriate scope.
- Explain how enclaves and external service providers affect scope.
Course Features
Designed for professionals preparing for the CCP exam.
Expert-Led Sessions
Live virtual sessions focused on how CMMC rules turn into assessment decisions.
Evidence Scenarios
Practice judging whether evidence shows a practice is met, the core skill the CCP exam tests.
Domain-Mapped Materials
Study materials organized by ISACA’s six CCP domains and their published weights.
Exam Readiness Review
Review of the exam structure, domain coverage, and scenario-style questions before you schedule.
Certification Exam
Prepare for the CMMC Certified Professional exam.
CCP Exam Readiness
Accumentum’s CCP course prepares you for all six CCP domains and the evidence and scoping decisions behind them.
ISACA administers the CCP exam as the CAICO for the Department of War’s CMMC program. ISACA calls CCP the foundational CMMC certification and the required first step toward CCA.
The CCP exam has 170 multiple-choice questions and runs 3.5 hours. It covers six domains: CMMC Ecosystem (5%), CMMC-AB Code of Professional Conduct (5%), CMMC Governance and Source Documents (15%), CMMC Model Construct and Implementation Evaluation (35%), CMMC Assessment Process (25%), and Scoping (15%).
Exams are computer-based and taken at PSI testing centers or through remote proctoring. After you register, you have six months to take the exam.
To become certified you must complete mandatory CCP training through an Approved Training Provider, pass the exam, submit the application, pay ISACA’s application processing fee, hold a favorable Tier 3 determination from the DoW, and follow ISACA’s Code of Professional Ethics and CPE policy. Under 32 CFR 170.13, CCP certification is valid for three years.
CMMC program status: the first phase began on November 10, 2025. On July 13, 2026, the Department of War suspended Phase II and started a review of the program. Phase 1 self-assessment requirements remain in place. Check the DoW CIO CMMC page for current status before you plan around a deadline.
Accumentum is an independent training provider. ISACA sets and changes exam rules, fees, and policies, so confirm current details on isaca.org before you register.
Exam Blueprint
Every CCP domain, in ISACA's words.
ISACA's CCP exam content outline has 6 job practice domains and 15 task statements. We've copied each one below exactly as ISACA lists it, with its weight.
Domain 1: CMMC Ecosystem (5%)
- A. Identify and compare roles/responsibilities/requirements of authorities across the CMMC ecosystem.
Domain 2: CMMC-AB Code of Professional Conduct (Ethics) (5%)
- A. Identify and apply knowledge of the guiding principles and practices of the CMMC-AB Code of Professional Conduct (CoPC)/ISO/IEC/DOW requirements.
Domain 3: CMMC Governance and Source Documents (15%)
- A. Demonstrate understanding of Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) in nonfederal unclassified networks.
- B. Determine the appropriate roles/responsibilities/authority for FCI and CUI.
- C. Demonstrate understanding of the CMMC source and supplementary documents.
Domain 4: CMMC Model Construct and Implementation Evaluation (35%)
- A. Given a scenario, apply the appropriate CMMC source documents as an aid to evaluate the implementation/review of CMMC practices. (At a minimum CCP candidate must be evaluated on CMMC L1 Practices during CCP exam.)
- B. Apply knowledge of the CMMC assessment criteria and methodology to the appropriate CMMC practices.
- C. Analyze the adequacy/sufficiency around the location/collection/quality/usage of evidence.
Domain 5: CMMC Assessment Process (CAP) (25%)
- A. Choose the appropriate roles of the CCP in the CMMC Assessment Process when developing the assessment plan (Phase 1 Plan and Prepare Assessment).
- B. Apply CMMC Assessment Process requirements pertaining to the role of the CCP as an Assessment Team Member while conducting a CMMC assessment (Phase 2 Conduct Assessment).
- C. Demonstrate comprehension of the CCP role in the preparation of assessment report (Phase 3 Report Assessment Results).
- D. Demonstrate comprehension of the CCP role in the process of evaluating outstanding assessment issues on plan of action and milestones (POA&M) (Phase 4 Evaluation of Outstanding Assessment POA&M Items).
- E. Given a scenario, determine the appropriate phases/steps to assist in the reparation/conducting/reporting on a CMMC Level 2 Assessment.
Domain 6: Scoping (15%)
- A. Understand CMMC high-level scoping as described in the CMMC Assessment Process.
- B. Given a scenario, analyze the organization environment to generate an appropriate scope for FCI Assets.
Who It Is For
Is CCP the right fit for you?
ISACA names five groups who benefit: DoW suppliers preparing for CMMC compliance, IT and security managers at DIB companies, GRC and compliance leads driving CMMC programs, aspiring CMMC assessors and early-career professionals entering DIB cyber compliance. CCP is also the required first step toward CCA.
Here's what ISACA requires before you're certified. Passing the exam is only one of the steps.
ISACA's CCP certification requirements
- Complete mandatory CCP training
- Pass the certification exam
- Pay the US$200 application processing fee
- Submit application
- Attain a positively adjudicated Tier 3 background investigation by the DoW
- Adhere to the Code of Professional Ethics
- Adhere to the Continuing Professional Education Policy
Exam Format
How the CCP exam works.
Exam details
- Questions: 170 multiple choice
- Length: 3.5 hours
- Language: English
- Delivery: PSI testing centers or remote proctoring
- Exam fee: US$575 for ISACA members, US$760 for non-members
- Application processing fee after you pass: US$200
- Eligibility: six months from registration
ISACA's outline leans on scenario questions. Several task statements open with "Given a scenario," so you'll be asked to apply the source documents to a situation, not just recall them.
We don't quote a passing score here. ISACA sets the scoring rules for its exams, and we point you to its candidate guide for the current details.
Study Plan
A practical path to CCP.
We start with CMMC Ecosystem. It's 5% of the exam, so we work its task statements against the CMMC source documents with evidence scenarios.
Next we cover CMMC-AB Code of Professional Conduct (Ethics). It's 5% of the exam, so we work its task statements against the CMMC source documents with evidence scenarios.
Then we move to CMMC Governance and Source Documents. It's 15% of the exam, so we work its task statements against the CMMC source documents with evidence scenarios.
After that comes CMMC Model Construct and Implementation Evaluation. It's 35% of the exam, so we work its task statements against the CMMC source documents with evidence scenarios.
We follow with CMMC Assessment Process (CAP). It's 25% of the exam, so we work its task statements against the CMMC source documents with evidence scenarios.
We wrap up with Scoping. It's 15% of the exam, so we work its task statements against the CMMC source documents with evidence scenarios.
CMMC Model Construct and Implementation Evaluation carries the most weight at 35%, so it gets the most review time. In the last week we run timed practice at the real pace and reread the outline line by line. Remember that our course is exam prep. It sits alongside the mandatory training from an Approved Training Provider on the CyberAB Marketplace, and it doesn't replace it.
Exam Policies
Scheduling and certification rules for CCP.
Exam registration is continuous, so you can register at any time. You can schedule a testing appointment as early as 48 hours after you pay, and appointments open only 90 days in advance.
You can reschedule without penalty during your eligibility period if you do it at least 48 hours before your appointment.
After you pass, you have five years to apply for CCP certification.
ISACA has a zero-tolerance policy for fraudulent test taking, and those involved face score nullification or certification revocation. The name on your ISACA account has to match your government-issued ID.
Career Outlook
Where CCP can take you.
CCP is aimed at people who prepare defense contractors for CMMC or join assessment teams. BLS doesn't track CMMC roles separately, so we use the closest occupation as a reference.
Per the U.S. Bureau of Labor Statistics, information security analysts earned a median annual wage of $129,180 in May 2025. BLS also projects employment of information security analysts to grow 21 percent from 2025 to 2035, much faster than the average for all occupations. Treat it as a reference point and not a promise. Location, experience and the employer drive what any one person earns. Source: BLS Occupational Outlook Handbook.
Funding
Ways to pay for CCP training.
Paying on your own? CCP prep is eligible for PathPay, our monthly payment plan. Terms of 3, 4 and 6 months carry no added fee. 9, 12 and 18 month terms add 5%, 10% and 15%. Course access opens when your first payment clears.
Our funding page lists every other way to pay, and you can always talk with us or email info@accumentum.net before you enroll.
Frequently Asked Questions
How Accumentum’s CCP course lines up with the exam, what ISACA requires to certify, and how CCP leads to CCA.
CCP is the foundational certification in the Department of War’s Cybersecurity Maturity Model Certification (CMMC) program. ISACA administers it and says it shows you are ready to help organizations reach assessment-ready cybersecurity or join a CMMC assessment team.
Yes. You must hold an active CCP before you can become a CMMC Certified Assessor (CCA). Accumentum also offers a CCA course for that next step.
No. Accumentum is not a CMMC Approved Training Provider. ISACA requires mandatory CCP training through an ATP listed on the CyberAB Marketplace. This course is exam preparation that sits alongside that training.
Six domains: CMMC Ecosystem (5%), CMMC-AB Code of Professional Conduct (5%), CMMC Governance and Source Documents (15%), CMMC Model Construct and Implementation Evaluation (35%), CMMC Assessment Process (25%), and Scoping (15%).
ISACA lists 170 multiple-choice questions in 3.5 hours. The exam is taken at a PSI testing center or through remote proctoring.
Yes. ISACA requires a favorably adjudicated Tier 3 background investigation by the DoW to become CCP certified. Under 32 CFR 170.13, the Tier 3 investigation does not result in a security clearance.
ISACA’s candidate guide lists no experience requirement for CCP. The Cyber AB has recommended a cyber or IT degree or two or more years of related experience, including military experience.
Phase 1 began on November 10, 2025, and its self-assessment requirements remain in place. On July 13, 2026, the Department of War suspended Phase II and started a review of the program. Check the DoW CIO CMMC page for current status.
The course is delivered as live virtual expert-led training with evidence scenarios, case discussions, and study materials mapped to the six CCP domains.
No. You earn CCP by meeting ISACA’s requirements, including ATP training, the exam, and the Tier 3 determination. Accumentum is an independent training provider, and ISACA sets the exam rules, fees, and policies.
ISACA lists US$575 for members and US$760 for non-members, plus a US$200 application processing fee once you pass.
Eligibility is good for six months from the date you register.
Yes, without penalty, as long as you do it at least 48 hours before your appointment and within your eligibility period.
ISACA gives you five years from passing the exam to apply.
Yes. CCP prep is eligible for PathPay. Terms of 3, 4 and 6 months add no fee, and longer terms add 5% to 15%.
Enrollment
Enroll in the CMMC Certified Professional (CCP) Certification Training Course with Accumentum.
Enroll in the CMMC Certified Professional™ (CCP™) Certification Training Course with Accumentum to prepare for the CCP exam.
You will work through all six CCP domains with an instructor and practice the evidence, scoping, and assessment process decisions the exam asks about.
Before you enroll, plan for ISACA’s mandatory ATP training and the Tier 3 background investigation, since both are required to certify. For course dates and enrollment help, visit Accumentum’s registration page.
Start your CMMC path with CCP training.
Prepare for the CCP exam while you learn how CMMC assessments work, then move on to CCA when you are ready.