CMMC Accreditation Body Advises Stakeholders to be Aware and Informed About Unauthorized Training Providers

June 29, 2021

(Bethesda, MD, June 29, 2021)—The CMMC Accreditation Body (CMMC-AB) is alerting all current and prospective members of the Cybersecurity Maturity Model Certification (CMMC) Ecosystem about companies and organizations misrepresenting their ability to train individuals in preparation for the CMMC assessor and CMMC instructor certification exams developed by the CMMC-AB in support of the Department of Defense's (DoD) CMMC initiative.

The CMMC-AB is the sole, authorized entity charged by DoD to license, certify, and manage the CMMC Ecosystem, which includes the training and certification for assessors and instructors at all levels.

For individuals who aspire to become trained and certified professional assessors or assessor instructors within the CMMC Ecosystem—specifically pursuing the Certified CMMC Professional (CCP), Certified CMMC Assessor 1 (CCA-1), and Certified CMMC Assessor 3 (CCA-3) exams—please take note of the following programmatic information and requirements:

• The CMMC-AB is currently developing the following three exams: CCP, CCA-1 and CCA-3. These exams will measure the CMMC knowledge of the individual and will be used to determine eligibility for license as a CMMC assessor or instructor at the various CMMC Levels within the maturity model framework.
• To meet quality requirements, only educational content that comes from a CMMC Licensed Partner Publisher (LPP) will be considered approved training material for preparing for the upcoming CMMC-AB individual certification exams.
• In addition, to meet quality requirements, only training services provided by a CMMC Licensed Training Provider (LTP) will serve as a valid pre-requisite for sitting for a CMMC-AB certification exam. All LTPs are required to use authorized training content provided by the LPPs. They are also required to use CMMC-AB certified instructors, currently identified as Provisional Instructors (PIs).
• Finally, only individuals obtaining training from authorized CMMC-AB providers (LTPs) will receive a CMMC-AB Professional Number (CPN) and be registered and have their progress tracked within DoD's Enterprise Mission Assurance Support System (eMASS), a requirement for attaining certification as a CMMC assessor or instructor.
• Since no CMMC training content has yet to be authorized for publication by LPPs, no LTPs are yet authorized to conduct official CMMC training in preparation for the upcoming CMMC-AB certification exams.

The CMMC-AB is currently working with DoD to finalize course objectives for both the CMMC assessor and CMMC instructor curricula. Until the CMMC-AB announces the completion of these curricula, no training classes promising preparation for CCP, CCA-1 and CCA-3 are authorized or valid for CMMC certification.

Please note that this advisory does not apply to any of the CMMC Registered Practitioners (RPs) and Registered Provider Organizations (RPOs) who are currently advising, consulting, or assisting Defense Industrial Base (DIB) companies and individuals prepare for CMMC certification within the maturity model framework. This CMMC-AB notice of caution is only concerning the formal training program for prospective CMMC assessors and instructors.

Once the CMMC-AB announces the approval of the final objectives, individuals are encouraged to visit the CMMC Marketplace to find the most up-to-date and accurate information on authorized CMMC publishers (LPPs) and training providers (LTPs). It is important to validate through the CMMC Marketplace that any training provider under consideration is an official CMMC-AB partner and not an organization falsely representing themselves as one.

To learn more about the accreditation process and the CMMC-AB, please visit: https://cyberab.org/