Written and maintained by CASRAI Editorial Board
Last updated
The CMMC CCA is the Certified CMMC Assessor credential: the individual qualification for people who carry out Cybersecurity Maturity Model Certification Level 2 assessments. As described on the official ISACA and Cyber AB pages on 2026-10-29, it sits one step above the CMMC Certified Professional (CCP) and is earned through approved training, a 150-question exam and an application showing experience. This guide separates which requirement comes from which organization, because the official pages split the rules between them.
What the CMMC CCA is and who runs it
Two organizations publish the CCA rules, and they cover different parts. ISACA, acting as the CMMC Assessor and Instructor Certification Organization (CAICO), runs the CCA course approval, the exam, the fees and the maintenance of the certification. The Cyber AB, the CMMC accreditation body, runs the ecosystem side: the Code of Professional Conduct, the Individual Service Agreement, the self-attested experience and the approved training provider (ATP) step. A third body, the Department of War (DoW), is the source of the Tier 3 determination that ISACA lists as a certification requirement.
In practice a CCA is the person who does the assessment work inside a certified third-party assessment organization. For the team rules (a Lead CCA plus at least one other CCA, and a quality assurance individual who must be a CCA) see what a C3PAO is and how its assessment teams are built and the CMMC Assessment Process (CAP).
Eligibility: CCP, experience, DoD 8140 and Tier 3
As described on the official ISACA CCA page on 2026-10-29, a candidate must:
- hold an active CCP certification and a certification from the DoD 8140 list;
- complete the mandatory CAICO-approved CCA course, delivered through an ATP listed on the Cyber AB Marketplace;
- hold a Tier 3 determination by the DoW, which the page lists as a certification requirement;
- show intermediate or advanced proficiency for the certified assessor career pathway (612) under DoD Manual 8140.3;
- submit an application demonstrating the experience requirements.
The Cyber AB assessors page states the experience in numbers: three years of cybersecurity experience, one year of audit or assessment experience, and at least one baseline certification aligned to the intermediate and/or advanced proficiency level. ISACA’s page asks for an application demonstrating experience but does not repeat those figures, so each figure is attributed to the page that states it.
Is Tier 3 needed before the exam?
No. ISACA states that candidates do not need to complete Tier 3 before taking CCA training, and the Tier 3 determination is not needed before the exam. It is still listed as a requirement for the certification itself, so it belongs in the plan from the start rather than at the end. For how the CCP stage fits in front of this, read the guide to the CMMC Certified Professional (CCP).
What the CCA requires: training, exam domains and fees
The exam is computer-based and is taken at an authorized PSI test center or remotely proctored. The ISACA exam content outline describes 150 questions across four job practice domains:
| Domain | Weight | Where to read more |
|---|---|---|
| 1. Evaluating OSCs Against CMMC Level 2 | 15% | CMMC Level 2 assessment |
| 2. CMMC Level 2 Assessment Scoping | 20% | CMMC Level 2 assessment |
| 3. CMMC Assessment Process (CAP) | 25% | CMMC Assessment Process (CAP) |
| 4. Assessing CMMC Level 2 Practices | 40% | CMMC Level 2 assessment |
The weighting is the most useful planning fact on the page: two-thirds of the exam (domains 3 and 4) is the assessment process and the practice-by-practice assessment itself, not scoping or eligibility. OSC means organization seeking certification.
How much does the CCA exam cost?
As described on the ISACA CCA page on 2026-10-29, exam registration is US$575 for ISACA members and US$760 for non-members, plus a US$50 application processing fee. ISACA says the annual renewal fee was lowered but the page gives no amount. The Cyber AB page lists no fee amounts and notes that all program fees are subject to change, so confirm current figures on the official pages before budgeting. Training provider fees for the mandatory course are set by each ATP and are separate.
Figures that differ by source
| Item | ISACA CCA page | Cyber AB assessors page |
|---|---|---|
| Experience | Application demonstrating the experience requirements; no figures given | Three years of cybersecurity experience, one year of audit or assessment experience |
| Fees | US$575 member / US$760 non-member exam, US$50 application processing | No amounts; fees subject to change |
| Training | CAICO-approved CCA course through an ATP | Complete CCA training with an Approved Training Provider (ATP) |
| Tier 3 | Listed as a certification requirement; not needed before training or exam | Step: provide active Tier 3 information, as needed; certification not granted until complete |
Application and compliance steps
The Cyber AB assessors page lists a longer sequence than the abridged one below, which leaves out the CCA application fee, Tier 3 information and fee-payment steps (Cyber AB says certification is not granted until all steps are complete). The page also says preparing to become a CCA requires participation on three Level 2 assessments for hands-on experience:
- Log in to the Cyber AB site with the CCP exam passed.
- Sign the Code of Professional Conduct and the Individual Service Agreement.
- Self-attest the experience requirements.
- Successfully complete CCA training with an Approved Training Provider.
- Pass the CCA exam.
The Code of Professional Conduct and Individual Service Agreement are re-signed if they change or when one year has passed. On the ISACA side, the certification is maintained through MyISACA under the ISACA CPE Policy.
Typical timeline phases
Neither organization publishes a single end-to-end schedule, so these phases come from the pieces each page does state:
- Prerequisites: the active CCP and a DoD 8140 listed certification must be in place.
- Training: the mandatory ATP course; Tier 3 does not have to be finished first.
- Exam window: eligibility lasts six months from registration. Scheduling is possible as early as 48 hours after payment and up to 90 days ahead, and rescheduling is free at least 48 hours before the appointment.
- Certification: the application, Tier 3 determination and annual maintenance complete the path.
Common mistakes
- Treating Tier 3 as an exam prerequisite. ISACA says it is not needed before the exam, but it is still required for the certification.
- Quoting experience figures from the wrong page. The three-year and one-year figures come from Cyber AB, not ISACA.
- Letting the six-month exam eligibility lapse. The window runs from registration, so register when a test date is realistic.
- Stating a renewal amount. ISACA gives none on the CCA page; check the current fee schedule.
Related programs
| Credential | What the official pages say (checked 2026-10-29) |
|---|---|
| CMMC Certified Professional (CCP) | Required before the CCA; see the CCP guide |
| CMMC Certified Assessor (CCA) | Needs an active CCP, a DoD 8140 certification, ATP-delivered CCA training and the CCA exam |
| Lead CCA (LCCA) | Named by ISACA as a designation; C3PAOs need at least one Certified Lead CCA |
FAQ
Do you need the CCP before the CCA?
Yes. ISACA lists an active CCP certification as a requirement, and the Cyber AB steps begin with the CCP exam passed.
What does a CCA do?
A CCA performs CMMC Level 2 assessment work on an assessment team. The exam domains show the scope: evaluating the organization against Level 2, scoping the assessment, following the CMMC Assessment Process and assessing the Level 2 practices. Team and quality-assurance rules are covered in the C3PAO guide.
Does a university or research institution need a CCA?
Institutions weighing their own CMMC obligations, rather than the assessor credential, will find those covered in CMMC compliance for research institutions.
How much does the CCA exam cost?
ISACA lists US$575 for members and US$760 for non-members, plus a US$50 application processing fee, as described on its CCA page on 2026-10-29. The Cyber AB lists no amounts and says program fees are subject to change.
Is Tier 3 needed before the exam?
No. ISACA says candidates do not need to complete Tier 3 before CCA training and the exam, but Tier 3 is still required for the certification.
Sources
- ISACA, CMMC Certified Assessor (CCA) certification page, https://www.isaca.org/credentialing/cca, checked 2026-10-29.
- ISACA, CCA exam content outline, https://www.isaca.org/credentialing/cca/cca-exam-content-outline, checked 2026-10-29.
- The Cyber AB, Assessors role detail, https://cyberab.org/CMMC-Ecosystem/Ecosystem-roles/Assessors-detail, checked 2026-10-29.
Programs and fees change; the facts above are as described on the official pages on 2026-10-29.
