1.2 Eligibility, Training, Retakes & Certification Maintenance

1.2 Eligibility, Training, Retakes & Certification Maintenance

The CCP pathway has two distinct gates: exam eligibility and certification eligibility. Completing training authorizes a candidate to register and test; passing the exam does not by itself create an active credential. The candidate must then satisfy the application, experience or education, background, ethics, and maintenance requirements published by ISACA.

Before the exam

The current program requires completion of the official CCP course through an ISACA Approved Training Provider (ATP). The ATP uses approved courseware and reports completion through the credentialing process. Self-study can reinforce the course but does not substitute for the mandatory training prerequisite.

After the prerequisite is accepted, exam registration eligibility is valid for six months. The candidate should schedule early enough to allow for PSI availability, identification issues, and possible rescheduling. Current delivery is through PSI, either at a test center or by remote proctoring. Use the current candidate guide for appointment changes and exam-day rules rather than relying on a provider's old instructions.

Current fees and score result

Every retake is a new full-fee exam registration at the candidate's then-current member status. The 200–800 scaled score uses 450 as the passing point. A failed result does not create partial certification, and an exam fee does not include the separate certification application.

Retake timing

ISACA permits up to four attempts in a rolling twelve-month period, including the first attempt. After the first failure, the candidate waits 30 days. After a second failure, the wait is 90 days. After a third failure, the wait is another 90 days. A candidate does not have to repeat the ATP course merely because of the first or second failure unless ISACA separately changes the prerequisite policy. The prudent response to a failed attempt is to use the score report to identify weak domains, rebuild the source-document map, and practice scenarios during the mandatory wait.

Applying for certification

Passing establishes the exam component. The current application also requires:

1. The qualifying education-or-experience basis: a cybersecurity or information-technology college degree, or at least two years of related education, or at least two years of related work experience, including qualifying military experience.
2. A completed certification application and the US$200 application fee.
3. A favorable Tier 3 background investigation or determination as required by the program. Do not assume that any commercial background check or any clearance automatically substitutes; ISACA and the responsible government process determine acceptability.
4. Agreement to the applicable professional ethics and continuing-certification requirements.

The role may expose a professional to proprietary security information and assessment records. That explains the screening requirement, but it does not make a CCP a cleared government employee and does not authorize access to classified or export-controlled information. Access remains governed by the data, contract, facility, citizenship or export rules, need to know, and the person's actual authorization.

Maintaining the credential

The CCP certification cycle is three years. A holder must earn at least 20 continuing professional education hours in each year and 120 total hours over the three-year cycle. The annual minimum is a floor, not the total requirement: three years at only 20 hours produces 60 and therefore does not satisfy 120. Plan approximately 40 hours per year while preserving the 20-hour yearly minimum.

CPE activities must be relevant and documented under ISACA's current policy. Examples may include approved training, professional education, teaching, research, or service when the policy recognizes the activity. Keep certificates, agendas, dates, providers, subject matter, and claimed hours because reported CPE may be audited. The holder must also maintain required fees and ethics attestations under the current policy; confirm fee amounts at renewal because they can change.

A practical pathway

A sound sequence is: select an ATP; complete the required course; confirm the six-month eligibility window; register with the correct ISACA member status; review PSI rules; pass at 450 or higher; collect education or experience documentation; submit the certification application; complete Tier 3 processing; then establish a three-year CPE calendar. Do not advertise an active CCP solely on the basis of course completion or a passing exam. Use the exact status reflected by ISACA.

Finally, separate individual certification from organizational qualification. A CCP certification does not turn an employer into a C3PAO, authorize the employer to issue certificates, or eliminate conflicts from consulting work. Those questions are governed by 32 CFR part 170, Cyber AB accreditation, CAP, and the Code of Professional Conduct.