# CMMC Defines CCP Assessment Limits

ISACA now administers CMMC Certified Professional (CCP) training, examinations, and certifications as the CAICO, while the Cyber AB retains responsibility for accreditation and Tier 3 investigations. Earning the credential requires approved training, passing an exam ($575 for ISACA members or $760 for nonmembers), paying a $200 application fee, and receiving a favorable Tier 3 determination. For contractors supporting CMMC Level 2 assessments, CCPs may verify Level 1 practices but cannot make final assessment determinations; this is a credentialing pathway, not an open procurement opportunity.

- Contractors can use CCPs to support the limited Level 1 verification work described, but should not rely on them to make final Level 2 assessment determinations.
- Organizations evaluating whether to pursue CCP certification should account for the required training, exam and application fees, and Tier 3 determination.
- The division of responsibilities between ISACA and the Cyber AB is relevant when planning staff credentialing and CMMC assessment support.

**Jurisdictions:** federal
**Industries:** Defense & Military
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** October 30, 2026

### Government Entities
- Department of War (DoW)

### Vendors
- ISACA (CCP training, examination, and certification administrator (CAICO))
- Cyber AB (CMMC accreditation and Tier 3 investigations oversight body)

### Sources
- [CMMC CCP: Requirements, Fees and Role — CASRAI](https://casrai.org/guides/cmmc-ccp) - CASRAI