Review of CMMC Registered Practitioner Training

This post was originally written in September 2020. It was updated in July 2024.

In September 2020, I took the Cyber-AB’s Registered Practitioner training course. We aren’t allowed to reproduce the content, so you won’t learn any secrets from me, but I can tell you about my experience.

How is the CMMC RP Training set up?

The Registered Practitioner training is included with your $500 annual fee to the Cyber-AB. It went live in September 2020 for those who had prepaid. I applied after the program became available and it took about 3 days to get access.

It is 100% web-based training provided directly through the Cyber-AB’s learning management system. I had no technical glitches using Chrome as my main browser.

This training is meant for people who want to help other organizations (clients) get ready for the CMMC. I’d say it is meant for internal employees of OSCs too, but since the RPs must be associated with an RPO or C3PAO, it appears this is geared more for consultants. Note: The AB website says that you need to associate with an RPO, but you should see the option to associate with C3PAOs as well during actual registration.

Code of Professional Conduct

You will be expected to abide by the Code of Professional Conduct if you sign up as a Registered Practitioner. The CoPC isn’t visible until you are partway through the registration process.

What is covered in the CMMC Registered Practitioner training?

The training spends a lot of time discussing the Cyber-AB and each role in the “CMMC ecosystem”. At the end of it you will definitely know which organization and role is responsible for what. It gives a brief introduction to reading the CMMC model document and a full description of the assessment and appeal process.

The training did not try to address technical questions about practices, it basically pointed at the CMMC model document. From the student perspective, this was frustrating.

There also seemed to be very little on the subject of building a system security plan, which I’d have figured is easily half of the workload for a registered practitioner. I don’t remember SSP being mentioned at all, but gathering evidence was. This is probably because a System Security Plan is only required at CMMC level 2+, but I’d make an exception to the focus on level 1 topics and discuss this. If a company hires a registered practitioner today, they are probably dealing with CUI.

The quiz questions were not great. They were about 50% a test of knowledge, 40% ability to read difficult wording, and 10% guessing about whether a term needed to be an exact match or partial match. If you take the training, I encourage you to give feedback to the Cyber-AB so they can improve it. At least the quizzes are forgiving – you can retry them but may be forced to wait a day between attempts.

So what is the value of CMMC Registered Practitioner?

Training?

The training is helpful to get you oriented to the concept of the CMMC. It introduces key terms, players, and roles in the CMMC ecosystem. It is not a replacement in any way for systems administrator, CMMC, or cybersecurity experience.

*Update May 31, 2021: The RP training is becoming increasingly obsolete over time. In particular, the training that describes how assessment quality reviews and appeals are structured and which states that RPs are eligible to participate in CMMC assessments no longer appears to be correct. Other topics are still accurate. “

Background Check

The Cyber-AB is organizing basic background checks (looking for felonies). You will be expected to register an account and perform a background check on yourself, then send the results to the CMMC-AB. This costs about $35.00.

Advertising

Once you get approved as an RP, the Cyber-AB says they will list you on their marketplace (advertising, connections). They also perform QA on registered practitioners: the Cyber-AB will revoke the badge if they find the person is acting against their code of conduct. *To my knowledge, no RP has had their badge stripped for bad conduct*

In my opinion, the endorsement provided by the Cyber-AB is the primary benefit of Registered Practitioner.

Do you need an RP for your org?

Registered Practitioner is NOT required for an individual to provide CMMC preparation services to organizations. An organization is allowed to utilize internal employees or use outside consultants with no Cyber-AB accreditations to get ready for the CMMC.

It is only when the organization is ready for their CMMC assessment that they are required to contract with a Cyber-AB Certified Third-Party Assessment Organization (C3PAO).

Now that Certified CMMC Professionals and Certified CMMC Assessors are available on the market, there is no reason to search for an RP. Serious professionals will take the formal training and pass the certification exam for Certified CMMC Professional to show their competency.

Wrap-up

Having RP doesn’t fulfill the need for self-study and spending hours considering the CMMC model in detail. For tips on that, I recommend reading through our assessor training resources page.

Thanks for reading!

I’d love to hear your thoughts and reviews on the Registered Practitioner training! Please send me a connection on LinkedIn or sign up for our newsletter for CMMC updates as they are published.

V. Amira Armond (CISSP, CISA, PMP, MBA) is a computer systems architect, cyber-security consultant, and owner of Kieri Solutions LLC. Kieri Solutions specializes in CMMC preparation and DFARS 252.204-7012 compliance, and designing secure and resilient enterprise systems for private sector and the DoD.  Amira is the chief editor for cmmcaudit.org, a non-sales website that provides news and informational articles about the Cybersecurity Maturity Model Certification.

Reference:

CMMC-AB Registered Provider Organization page

CMMC-AB Registered Practitioner Page