What is a CMMC Certified Professional (CCP)? | Requirements & Role Explained

The Cybersecurity Maturity Model Certification (CMMC) is a framework developed by the U.S. Department of Defense to ensure contractors safeguard Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). A CMMC Certified Professional (CCP) serves as a foundational role in the CMMC ecosystem. CCPs are trained in the model’s structure, assessment process, and requirements, and they may support consulting efforts, prepare organizations for assessment, or join assessment teams under a CMMC Certified Assessor (CCA).

The CMMC CCP Is the Gateway to CCA

You must become a CCP before earning the CMMC Certified Assessor (CCA) certification.

Eligibility Criteria for CCP

CCP candidates typically need:

• A cybersecurity or IT-related college degree or 2+ years of equivalent experience

• CompTIA A+ certification (or equivalent)

• Completion of DoD CUI Awareness training

Certification Requirements

To earn the CCP credential you must:

• Apply and remain in good standing with the Cyber AB

• Complete CCP training via an Authorized Training Provider

• Pass the CCP exam

• Obtain a Tier 3 suitability determination from the DoD

Do I Have to be a U.S. Citizen to Become a CCP?

No. While in the past this was essentially true, it no longer is the case. As part of the Tier 3 determination noted above, there is also equivalency. The current program allows non-U.S. individuals to complete the Tier 3 process under the same standards as U.S. citizens. When you complete the initial paperwork, information will be collected about your citizenship. The DoD will note this information and manage the equivalent background check process.

Do I Need to Wait for My CCP Certification Before Starting CCA Training?

No. You can begin CCA training at any time. In fact, many students choose to take the CCA course right before sitting for the CCP exam, as it serves as a helpful refresher on key CCP concepts.

Do I Need to Wait for My Tier 3 (or Equivalent) to Start CCA Training?

No. You can begin your CCA training at any time. Since the Tier 3 or equivalent suitability determination can take several weeks or even months, many students choose to complete the training and other certification requirements in the meantime. Once your Tier 3 (or equivalent) is approved, you’ll fully meet the eligibility requirements for both CCP and CCA certification.

What CCPs Can Do

• Participate on Level 2 assessments under a C3PAO, but only to verify Level 1 practices and under supervision. CCPs cannot make final assessment determinations

• Serve as assessment team members, supporting data gathering and control evaluation

• Assist OSAs/OSCs with understanding CMMC requirements and readiness preparation.

What CCPs Cannot Do

CCPs are not authorized to lead certification assessments or sign off on official findings — that authority rests with CCAs or Lead CCAs.

Why the CCP Matters

The CCP credential validates your knowledge of CMMC fundamentals and authorizes you to gain practical experience on assessment teams. It’s the essential first step toward becoming a CCA and playing a meaningful role in the CMMC assessment ecosystem.