1.1 Exam Structure, Current Logistics & Official Blueprint
Key Takeaways
- The current ISACA CCP exam has 170 multiple-choice questions, a 210-minute limit, and a scaled passing score of 450 on a 200–800 scale.
- ISACA delivers the exam through PSI at test centers or by remote proctoring; the exam is closed book and currently offered in English.
- The six official domains are Ecosystem 5%, Code of Professional Conduct 5%, Governance and Source Documents 15%, Model Construct and Implementation Evaluation 35%, Assessment Process 25%, and Scoping 15%.
- ISACA is the current CMMC Authorized CMMC Individual Certification Organization, while The Cyber AB remains the accreditation body for the CMMC ecosystem.
- A CCP may advise organizations and may participate on an assessment team, but may only verify Level 1 practices during a Level 2 assessment and does not make final determinations.
1.1 Exam Structure, Current Logistics & Official Blueprint
The Certified CMMC Professional (CCP) is the foundational individual credential in the Cybersecurity Maturity Model Certification ecosystem. It tests whether a candidate can explain the program, use its governing source documents, recognize the CMMC model and scoping rules, and support an assessment without exceeding the authority of the credential. Current exam facts must come from ISACA's CCP Exam Content Outline and the current CCP/CCA Exam Candidate Guide, not legacy Cyber AB handbooks or old training advertisements.
Current exam facts
| Feature | Current requirement |
|---|---|
| Credentialing organization | ISACA, the current Authorized CMMC Individual Certification Organization (CAICO) |
| Questions | 170 multiple-choice questions |
| Time | 210 minutes, or 3.5 hours |
| Scoring | Scaled from 200 to 800; 450 or higher passes |
| Delivery | PSI test center or PSI remote proctoring |
| Language | English |
| Exam environment | Closed book |
The candidate guide explains that pretest questions may appear, but it does not publish a scored-versus-unscored item count. Treat every item as operational. The scaled score is not a percentage: a score of 450 does not mean 45%, and a candidate cannot calculate the passing raw-question count from the published scale.
A useful pacing baseline is 210 minutes divided by 170 questions, about 74 seconds per question. That is an average, not a time limit per item. Make a first pass through direct knowledge questions, flag longer scenarios, and reserve time to review unanswered items. PSI's current candidate rules govern identification, permitted materials, breaks, workspace checks, and remote-proctor requirements; confirm them in the current candidate guide before the appointment.
The six-domain blueprint
| Domain | Weight | What the candidate must be able to do |
|---|---|---|
| 1. CMMC Ecosystem | 5% | Distinguish DoD, Cyber AB, ISACA/CAICO, C3PAO, training, consulting, assessor, and OSC roles. |
| 2. CMMC Code of Professional Conduct | 5% | Apply integrity, objectivity, confidentiality, lawful conduct, conflicts, contracts, and reporting duties. |
| 3. CMMC Governance and Source Documents | 15% | Navigate laws, clauses, CUI authorities, the model, assessment guides, scoping guides, CAP, glossary, and registries. |
| 4. CMMC Model Construct and Implementation Evaluation | 35% | Explain levels and domains; apply NIST SP 800-171A objectives and Examine, Interview, and Test methods; evaluate evidence. |
| 5. CMMC Assessment Process | 25% | Apply CAP activities from preliminary proceedings through assessment, reporting, certification, and POA&M closeout. |
| 6. CMMC Scoping | 15% | Determine organizational and assessment scope, asset categories, people, facilities, technology, CSPs, and ESPs. |
The two largest domains—Model Construct and Implementation Evaluation and the Assessment Process—represent 60% of the outline. That weighting supports deep scenario practice, but the remaining domains are not optional. A scoping mistake can invalidate technical conclusions, and an ethics violation can disqualify an otherwise competent assessor.
Who governs what
DoD owns the CMMC program and codified it in 32 CFR part 170. DCMA DIBCAC conducts Level 3 assessments and performs government assessment functions assigned by rule. The Cyber AB is the CMMC Accreditation Body and accredits C3PAOs and manages applicable ecosystem recognition. ISACA is the current CAICO: it administers professional training, examinations, certification applications, and certification maintenance. C3PAOs perform authorized Level 2 certification assessments through qualified teams and their quality system.
Use current names. Training is delivered through an Approved Training Provider (ATP) using approved curriculum. An Approved Publishing Partner (APP) develops approved training materials. Older documents may say Licensed Training Provider or Licensed Publishing Partner; those labels are historical and should not be mistaken for current program terminology.
CCP authority and limits
Under 32 CFR §170.13, a CCP may provide advice, consulting, recommendations, and assessment-team support consistent with training and the Code of Professional Conduct. Current ISACA guidance is more precise about formal Level 2 work: a CCP with the required Tier 3 determination may verify Level 1 practices as a team member, but may not make the final determination. CCAs assess Level 2 requirements; the Lead CCA leads the team. A CCP cannot lead a certification assessment, act as the C3PAO quality authority, sign or issue a certificate, upload results merely by virtue of holding the CCP credential, or assess a client when prohibited conflicts exist.
Keep three kinds of work separate. A CCP may consult for one client. A CCP may participate within authorized limits on a different client's assessment. A CCP may also work internally for an organization. The title never erases independence rules or expands the formal assessment authority assigned to CCAs, C3PAOs, quality personnel, and certifying officials.
Source-control rule for exam facts
CMMC materials changed providers and processes over time. When sources conflict, use the current ISACA content outline and candidate guide for the exam; 32 CFR part 170 for binding program roles, assessment levels, affirmations, and POA&M rules; the current DoD model and scoping guides for requirements and boundaries; and CAP 2.0 for the commercial certification-assessment workflow. Date-stamp notes and distinguish a live rule from historical blueprint context.
Which statement matches the current CCP exam?
Which pair carries the greatest combined weight in the current outline?
What may a properly eligible CCP do on a Level 2 certification assessment?