CMMC Professional
ISACA CMMC Certified Professional (CCP) teaches the CMMC ecosystem, professional conduct, governance, model constructs, and assessment process, enabling learners to guide organizations toward compliant certification.
210
Minutes
170
Questions
500/800
Passing Score
$760
Exam Cost
Who Should Take This
Mid‑level security analysts, compliance officers, or IT auditors who have basic familiarity with NIST 800‑171 and seek to expand their expertise in CMMC implementation. They aim to master the governance framework, assessment methodology, and ethical standards required to support organizations in achieving and maintaining CMMC certification.
Course Outline
1Domain 1: CMMC Ecosystem 1 topic
CMMC program structure
- Identify the key organizations and roles within the CMMC ecosystem including DoD, CAICO, C3PAOs, certified assessors, and organizations seeking certification.
- Describe the CMMC certification lifecycle including assessment initiation, pre-assessment activities, formal assessment, scoring, and certification issuance.
- Apply understanding of CMMC ecosystem relationships to identify appropriate engagement models and communication channels for assessment activities.
- Identify the principal stakeholders in the CMMC ecosystem (DoD CIO, OSD, The Cyber AB, C3PAOs, OSCs, CCPs, CCAs, instructors).
- Apply the CMMC ecosystem to determine which entities are involved in a sample certification engagement.
- Identify the principal stakeholders in the CMMC ecosystem (DoD CIO, OSD, The Cyber AB, C3PAOs, OSCs, CCPs, CCAs, instructors).
- Apply the CMMC ecosystem to determine which entities are involved in a sample certification engagement.
2Domain 2: Code of Professional Conduct 1 topic
Ethics and professional conduct
- Identify the principles and requirements of the CMMC Code of Professional Conduct including integrity, objectivity, confidentiality, and professional behavior.
- Apply conflict of interest identification and management procedures to ensure independence and objectivity during CMMC assessment activities.
- Analyze professional conduct scenarios to determine appropriate ethical responses and escalation actions within the CMMC ecosystem.
- Identify the principles of the CCP code of professional conduct (integrity, objectivity, confidentiality, due care, professionalism).
- Examine ethical dilemmas (conflict of interest, gift acceptance, scope creep) and recommend principle-aligned responses.
- Identify the principles of the CCP code of professional conduct (integrity, objectivity, confidentiality, due care, professionalism).
- Examine ethical dilemmas (conflict of interest, gift acceptance, scope creep) and recommend principle-aligned responses.
3Domain 3: CMMC Governance and Source Documents 2 topics
Regulatory framework
- Identify the regulatory basis for CMMC including 32 CFR Part 170, DFARS 252.204-7012, and the relationship between CMMC requirements and federal acquisition regulations.
- Describe the relationship between CMMC levels and NIST SP 800-171 and SP 800-172 security requirements including practice mapping and assessment criteria.
- Apply knowledge of CMMC governance documents to interpret assessment requirements, scoring criteria, and certification decision processes.
- Apply the CMMC source-document hierarchy (DoDI 5200.48, DFARS 252.204-7012/7019/7020/7021, NIST SP 800-171) to compliance scoping.
- Apply the CMMC source-document hierarchy (DoDI 5200.48, DFARS 252.204-7012/7019/7020/7021, NIST SP 800-171) to compliance scoping.
Source document navigation
- Identify key CMMC source documents including the CMMC Assessment Guide, CMMC Scoping Guide, and associated NIST publications and their roles in assessments.
- Apply CMMC source document references to resolve assessment questions and validate practice implementation interpretations.
- Examine recent CMMC rule changes and recommend implementation updates for an OSC.
- Examine recent CMMC rule changes and recommend implementation updates for an OSC.
4Domain 4: CMMC Model Construct and Implementation Evaluation 4 topics
CMMC model structure
- Describe CMMC maturity levels including Level 1 (Foundational), Level 2 (Advanced), and Level 3 (Expert) and their corresponding security requirements and assessment methods.
- Identify the 14 NIST SP 800-171 security requirement families and their 110 security requirements that map to CMMC Level 2 practices.
- Apply CMMC practice implementation guidance to evaluate whether organizational security controls satisfy specific CMMC requirements.
- Identify the CMMC three-level model and the source-document basis for each level (FAR 52.204-21 for L1, NIST SP 800-171 for L2, NIST SP 800-172 for L3).
- Identify the CMMC three-level model and the source-document basis for each level (FAR 52.204-21 for L1, NIST SP 800-171 for L2, NIST SP 800-172 for L3).
Access control and identification practices
- Apply evaluation techniques to assess access control implementations including account management, access enforcement, information flow control, and separation of duties.
- Apply evaluation techniques to assess identification and authentication controls including multi-factor authentication, password policies, and authenticator management.
- Analyze access control evidence including access control lists, user provisioning records, and audit logs to determine practice implementation adequacy.
- Apply NIST SP 800-171 control families and the practices each contains to evidence collection.
- Apply NIST SP 800-171 control families and the practices each contains to evidence collection.
Configuration, media, and system protection practices
- Apply evaluation techniques to assess configuration management practices including baseline configurations, change control, and security configuration enforcement.
- Apply evaluation techniques to assess media protection and physical protection controls including CUI marking, media sanitization, and physical access restrictions.
- Apply evaluation techniques to assess system and communications protection including boundary protection, encryption, and session management controls.
- Analyze system security plan documentation to verify completeness, accuracy, and alignment of documented controls with actual implementation.
Audit, incident response, and awareness practices
- Apply evaluation techniques to assess audit and accountability controls including audit log generation, review, analysis, and retention for CUI environments.
- Apply evaluation techniques to assess incident response capabilities including incident handling procedures, reporting requirements, and testing of response plans.
- Apply evaluation techniques to assess security awareness and training programs including role-based training, insider threat awareness, and CUI handling procedures.
- Analyze risk assessment and security assessment practices to evaluate organizational risk management maturity and vulnerability management effectiveness.
5Domain 5: CMMC Assessment Process 2 topics
Assessment methodology
- Describe the CMMC Assessment Process phases including pre-assessment, assessment, and post-assessment activities and their key deliverables.
- Apply assessment evidence collection techniques including document review, interview procedures, and technical testing to validate practice implementation.
- Apply CMMC scoring methodology to determine practice assessment results including Met, Not Met, and Not Applicable determinations.
- Analyze assessment findings to develop Plan of Action and Milestones (POA&M) entries and determine conditional certification eligibility.
Process Mechanics
- Identify the phases of the CMMC Assessment Process (planning, conducting, reporting) and the roles of each participant.
- Construct an assessment plan that documents scope, schedule, evidence requests, and stakeholder responsibilities.
- Apply MET/NOT MET/NOT APPLICABLE scoring with appropriate evidence rationale, applying the concept to a realistic scenario the practitioner is likely to encounter.
6Domain 6: Scoping 1 topic
CMMC assessment scoping
- Identify CUI and FCI data types and describe the criteria for determining which information requires CMMC Level 1 versus Level 2 protection.
- Apply asset categorization procedures to classify systems as CUI Assets, Security Protection Assets, Contractor Risk Managed Assets, or Specialized Assets.
- Apply security boundary determination techniques to define the assessment scope including network enclaves, external service providers, and out-of-scope systems.
- Analyze scoping decisions to validate that all CUI processing, storage, and transmission pathways are captured within the assessment boundary.
7Domain 7: Professional Practice 1 topic
Career Development
- Identify the maintenance requirements for CCP credential (CPEs, code-of-conduct adherence, recertification cycles).
- Recommend a 24-month CPE plan that maintains CCP credentialing and broadens cybersecurity expertise.
Exam Structure
Question Types
- Multiple Choice
Scoring Method
Scaled score 500-800 required to pass (out of 200-800 range)
Delivery Method
PSI online proctored or test center
What's Included in AccelaStudy® AI
Adaptive Knowledge Graph
Practice Questions
Lesson Modules
Console Simulator Labs
Exam Tips & Strategy
34 Activity Formats
Scope
Included Topics
- All domains and objectives in the CMMC Certified Professional (CCP) exam: Domain 1 CMMC Ecosystem (5%), Domain 2 CMMC-AB Code of Professional Conduct (5%), Domain 3 CMMC Governance and Source Documents (15%), Domain 4 CMMC Model Construct and Implementation Evaluation (35%), Domain 5 CMMC Assessment Process (25%), and Domain 6 Scoping (15%).
- Foundational CMMC knowledge including CMMC ecosystem structure, program governance, regulatory framework, assessment methodology, and implementation guidance for organizations seeking certification.
- CMMC model understanding: maturity levels (Level 1 through Level 3), security domains, practices, process maturity, and mapping to NIST SP 800-171 and NIST SP 800-172 security requirements.
- CMMC assessment process: assessment preparation, evidence collection, interview techniques, scoring methodology, Plan of Action and Milestones (POA&M), conditional certification, and assessment reporting.
- Scoping: Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) identification, asset categorization, security boundary determination, and enclave scoping for CMMC assessments.
- CMMC governance: Code of Professional Conduct, conflict of interest management, assessment team composition, and quality assurance in the CMMC ecosystem.
Not Covered
- Advanced CMMC assessment leadership and team management (covered by CCA and LCCA).
- CMMC instructor pedagogy and curriculum delivery (covered by CCI).
- General cybersecurity operations and SOC procedures (covered by CCOA).
- Broad information security management beyond CMMC scope (covered by CISM).
- Vendor-specific security tool implementation for CMMC compliance.
Official Exam Page
Learn more at ISACA