Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
A reference to the CMMC assessor credential as of October 2026, covering the four exam domains, the 150-question exam, the CCP and Tier 3 prerequisites, ISACA's move into the CAICO role, the path to Lead CCA, and where the CCA sits under the 32 CFR Part 170 rule. Written for anyone weighing the CCA or trying to work out what it actually takes.
The CCA is the certification a person needs to conduct CMMC Level 2 certification assessments. CCAs work for a C3PAO (a CMMC Third-Party Assessment Organization) and decide whether a defense contractor meets the 110 NIST SP 800-171 requirements that make up Level 2.
The issuer changed in 2026. The rule calls the certifying body the CMMC Assessor and Instructor Certification Organization, or CAICO. The Cyber AB, the program's accreditation body, used to run that function. On December 17, 2025, ISACA announced it had been authorized as the new and exclusive CAICO, with the full transition of services by April 1, 2026. The Cyber AB is still the accreditation body and still runs point on Tier 3 investigations. Exams, applications and renewals now go through ISACA, so older guides that send you to the Cyber AB site to register describe a process that has ended.
What it tests is the assessor's job as 32 CFR Part 170 defines it. CCAs assess contractors against NIST SP 800-171A, following the assessment process in section 170.17 and the Level 2 scoping rules in section 170.19. The four exam domains follow that work in order: evaluate the organization seeking certification, set the scope, run the assessment process, then judge the evidence practice by practice. That last domain alone is 40 percent of the exam.
Getting the CCA takes far more than an exam. Section 170.11 of the rule requires every CCA to hold the CCP first, along with three years of cybersecurity experience, one year of assessment or audit experience, a DoD 8140 qualification for work role 612, and a Tier 3 determination. ISACA's candidate guide states that ANAB accredits the CCA under ISO/IEC 17024:2012. The CCA is issued and maintained by ISACA.
The environment of the organization seeking certification. 15% of the exam.
The five asset categories and where the boundary sits. 20% of the exam.
Plan, prepare, conduct and report a Level 2 assessment. 25% of the exam.
Evidence, methods and objects for each practice. The heaviest domain at 40%.
Four ways the credential works differently from most of the certifications on a security resume.
The CCA is written into federal regulation. Under 32 CFR 170.9, every C3PAO Assessment Team needs at least two people: a Lead CCA and at least one other CCA. CCPs can join the team, but the rule leaves the final determinations to the CCA. The person running a C3PAO's quality assurance review also has to be a CCA, and cannot sit on the team being reviewed.
You cannot take the CCA cold. The CCP comes first, then the approved CCA course from an Approved Training Provider, then the exam. Certifying also takes three years in cybersecurity, a year of assessment or audit work, a work role 612 baseline certification and a Tier 3 determination. Each gate keeps the assessor pool small and vetted.
On July 13, 2026, the Department of War (the name the Department of Defense now also uses) suspended Phase 2 of the CMMC rollout and set up a CMMC Reform Task Force. Phase 1 and the 32 CFR Part 170 rule that defines the CCA are still in force. Our look at the certifications government contractors require covers the wider federal picture.
ISACA does not claim a DoD 8140 listing for the CCA. The relationship runs the other way. The rule requires every CCA to hold a qualification aligned to at least the Intermediate proficiency level of work role 612, Security Control Assessor, under DoD Manual 8140.03. The Cyber AB's qualifying table (September 2025) includes Security+, CGRC, PenTest+, Cloud+ and SecurityX at Intermediate, and CISA, CISM, CISSP, CySA+ and CCISO at Advanced.
ISACA also requires you to keep that prerequisite certification active for as long as you hold the CCA, and Lead CCAs need a 612 qualification at the Advanced level. Current DoD qualification matrices are published at the DoD Cyber Exchange.
The certification, the exam, and what it costs to keep the CCA as of October 2026. Every figure below comes from ISACA or the 32 CFR Part 170 rule.
The CCA lets you assess. From there people lead assessments, teach the next group of assessors, or add the Advanced work role 612 credential the lead role asks for. These three steps come up most often.
The Lead CCA designation lets you run the team. The rule asks for five years of cybersecurity experience, five years of management experience, three years of assessment or audit experience and an Advanced 612 qualification. ISACA charges a $500 application fee and a $500 annual fee, and asks for no CPEs beyond the CCA's own.
The CMMC Certified Instructor credential lets you teach. Under the rule, a CCI who holds a valid CCA may instruct CCP, CCA and CCI candidates. A CCI with only the CCP is limited to CCP classes, so the CCA is what opens the full teaching scope.
If your 612 baseline is Security+ or CGRC, both at the Intermediate level, the Lead CCA path needs something stronger. ISACA's CISA sits at the Advanced level for work role 612 and is close to assessment work already. Read what CISA covers.
The CCA sits in the middle of the CMMC assessor ladder. It builds on the CCP and a work role 612 baseline, and leads to the Lead CCA designation or to teaching.
Meet the prerequisites
Conduct Level 2 assessments
Two questions to answer before you commit: can you certify, and should you pursue the CCA specifically. Here's a straight answer to both.
You can certify in full.
You hold an active CCP, three or more years of cybersecurity experience, at least a year of assessment or audit work, and a certification at the Intermediate or Advanced level for work role 612. Take the CAICO-approved CCA course from an Approved Training Provider, pass the exam, pay the $50 application fee and apply with your experience documented. The Tier 3 process normally starts at the CCP stage, when ISACA validates your application and sends your details to The Cyber AB.
You can still test now.
ISACA checks experience when you apply for certification, and Tier 3 is not required for the CCA course or the exam. Its registration notes do ask for an active CCP and a certification from the DoD 8140 list, so put those in place first. Until you certify, the CCP lets you join Level 2 assessment teams under CCA oversight, which builds assessment experience. ISACA's own pages give different deadlines for applying after you pass, so confirm the current window before you test early.
The CCA maps to a short list of roles, and the 32 CFR Part 170 rule defines most of them. The first four cards are roles the rule ties directly to the CCA. The last two sit on the contractor and consulting side, where ISACA says the credential is also aimed.
Conducts Level 2 certification assessments for a C3PAO, using NIST SP 800-171A, the CMMC Assessment Process and the Level 2 scoping rules. Section 170.11 of the rule defines the role, and the CCA is the only way into it.
Leads the C3PAO Assessment Team, which the rule says must include a Lead CCA and at least one other CCA. ISACA describes the Lead CCA as holding final determination authority for Level 2 certifications.
Checks assessment data for accuracy and completeness before it goes into the CMMC instance of eMASS, and manages the C3PAO appeals process. The rule requires this person to be a CCA who is not on the team being reviewed.
Teaches the next round of candidates. A CCI who holds a valid CCA may instruct CCP, CCA and CCI candidates, which is the widest teaching scope the rule allows.
Owns the NIST SP 800-171 program inside a defense contractor and gets it ready for assessment. ISACA lists government contractor and defense industry staff among the people the CCA is built for, and knowing how an assessor scores helps from the other side of the table.
Helps contractors prepare for a Level 2 assessment. The conflict rules matter here. Under 32 CFR 170.8, The Cyber AB must bar anyone who consulted to prepare an organization from taking part in that organization's Level 2 certification assessment within three years.
All three are ISACA credentials now, and they often end up on the same resume. They answer different questions: can you run a CMMC assessment, can you support one, can you audit anything. Here's how they line up.
| CCA | CCP | CISA | |
|---|---|---|---|
| Issuer | ISACA (as CAICO) | ISACA (as CAICO) | ISACA |
| Focus | Conducting Level 2 assessments | CMMC foundations and team support | IS audit and assurance |
| Domains | 4 | 6 | 5 |
| Exam Format | 150 questions, 4 hrs | 170 questions, 3.5 hrs | 150 questions, 4 hrs |
| Experience | CCP plus 3 yrs cyber, 1 yr assessment | None required | 5 yrs IS audit, control, or security |
| Passing Score | 450 / 800 | 450 / 800 | 450 / 800 |
| Exam Cost | $575 member / $760 non-member | $575 member / $760 non-member | $575 member / $760 non-member |
| Renewal | 120 CPEs over 3 years | 120 CPEs over 3 years | 120 CPEs over 3 years |
| Role in CMMC | Makes final determinations | Joins teams under CCA oversight | Advanced 612 baseline |
| Best For | Assessors at C3PAOs | Readiness consultants, new team members | IT auditors and assurance leads |
Prices are ISACA's published US figures and depend on membership status at registration. The usual CMMC sequence is the CCP first, then the CCA once the experience and the 612 baseline are in place. Using CISA as that baseline also covers the Advanced level the Lead CCA designation asks for.
Certification Matchups: the published facts, strengths and weak spots of 33 certifications, side by side.
Our four-day CMMC Certified Assessor boot camp is delivered with ecfirst, a CMMC Approved Training Provider and C3PAO, live online or in person. The week covers all four exam domains with labs and a mock Level 2 assessment, and you keep instructor access and the ecfirst Academy Portal while you schedule the exam with ISACA. It is built for people who already hold the CCP.
The CMMC program, DoD 8140 baselines, the GRC field around them, and the exam and renewal rules ISACA runs.
A plain-language primer on the three CMMC levels, the 110 NIST SP 800-171 requirements behind Level 2, and the documentation contractors build before an assessor arrives.
Which certifications show up in DoD contract requirements, how DoD 8140 work roles changed the picture, and where CMMC fits for contractor staff.
How a certification gets onto the DoD 8140 matrix in the first place. Useful background when you are choosing the work role 612 baseline the CCA requires.
CGRC is one of the Intermediate work role 612 credentials that meets the CCA baseline. This walkthrough covers what it tests and the authorization work it fits.
Where assessment and compliance credentials sit among CRISC, CISA, CISM and CGRC, and which one matches the GRC job you are aiming at.
How ISACA's calendar-year CPE cycle works, including the 20-hour annual floor that applies to CCA holders as well.
ISACA tests through PSI at a center or remotely, with a mirror check for remote sessions. Check-in, breaks and retake waits compared across vendors.
ISACA's CCA exam content outline splits the exam into four domains that follow a Level 2 assessment from the first look at the contractor to the final scoring of each practice, and each domain carries its own weight. Click any domain for what it covers.
Sizing up the organization before anyone scores a practice. ISACA's single task statement here is to assess the environmental considerations of an OSC against Level 2. In practice that means how the contractor is set up, the cloud and external service providers it relies on, and what its system security plan says about each of them.
Deciding what is in the assessment and what is not. You analyze assets against the five categories in the CMMC Level 2 Assessment Scoping Guide (CUI Assets, Security Protection Assets, Contractor Risk Managed Assets, Specialized Assets and Out-of-Scope Assets), work scenarios where assets have been recategorized, and weigh the considerations that decide where the boundary sits.
The method itself. Scenario questions ask you to apply the right phases and steps to plan, prepare, conduct and report on a Level 2 assessment. It is the same sequence a C3PAO team follows before its results go into the CMMC instance of eMASS.
The heaviest domain by a wide margin. For each practice you identify the right verification and validation methods and assessment objects, based on the CMMC Level 2 Assessment Guide and CAP documentation. Under the rule every requirement ends as MET, NOT MET or NOT APPLICABLE, and evidence has to be in final form, not a draft.
Domains and weights reflect ISACA's CCA exam content outline and its 2026 CCP and CCA Exam Candidate Guide, the version ISACA administers as of October 2026.
The questions candidates ask most often when researching the CMMC Certified Assessor certification.
The CCA is the certification required to conduct CMMC Level 2 certification assessments. CCAs work for a C3PAO and assess whether a defense contractor handling Controlled Unclassified Information meets the 110 NIST SP 800-171 requirements of Level 2. ISACA issues it as the program's CMMC Assessor and Instructor Certification Organization (CAICO), under requirements set in 32 CFR 170.11.
ISACA. On December 17, 2025, ISACA announced it had been authorized as the new and exclusive CAICO, with the full transition of services by April 1, 2026. The Cyber AB, which ran the CAICO function before, remains the CMMC accreditation body and still runs point on Tier 3 investigations for CCPs and CCAs. Exam registration, certification and renewal now go through ISACA.
The CCA fits people who want to conduct CMMC Level 2 certification assessments: current CCPs with audit or assessment backgrounds, staff at C3PAOs, and experienced risk and compliance professionals in the defense industrial base. It is also the required step toward the Lead CCA designation. It is a poor fit for people who are new to security or have no assessment experience yet.
As of October 2026, the CCA exam costs US$575 for ISACA members and US$760 for non-members, paid to ISACA at registration. Passing candidates then pay a one-time US$50 application processing fee. Exam fees are nonrefundable, and each retake is charged in full.
The CCA exam is 150 multiple-choice questions over four hours (240 minutes), in English. It is computer-based and delivered at PSI test centers or by remote proctoring. Scores are reported on a 200 to 800 scale and you need 450 to pass. You see a preliminary result on screen, and the official score arrives within ten working days.
To register for the exam, ISACA lists an active CCP, the CAICO-approved CCA course from an Approved Training Provider, and a certification from the DoD 8140 list. That certification must align to at least the Intermediate level of work role 612. To certify, 32 CFR 170.11 also requires three years of cybersecurity experience, one year of assessment or audit experience, and a Tier 3 determination or DoD-approved equivalent. Tier 3 is not needed to take the course or the exam.
The four CCA domains are Evaluating Organizations Seeking Certification (OSC) Against CMMC Level 2 (15 percent), CMMC Level 2 Assessment Scoping (20 percent), CMMC Assessment Process (CAP) (25 percent), and Assessing CMMC Level 2 Practices (40 percent). The last domain, judging evidence practice by practice, carries the most weight.
Under 32 CFR 170.11, a CCA certification is valid for three years from issuance. ISACA keeps it active through 120 CPE hours over a three-year reporting period, with at least 20 hours a year and two a year on CMMC rules, plus an annual maintenance fee of US$90 for members or US$170 for non-members, due by January 1. You also have to keep your 612 prerequisite certification active.
ISACA does not claim a DoD 8140 listing for the CCA. The relationship runs the other way, because the CCA requires a DoD 8140 qualification. Candidates must hold a certification aligned to at least the Intermediate level of work role 612, Security Control Assessor, such as Security+ or CGRC. Lead CCAs need one at the Advanced level, such as CISA, CISM or CISSP. See the full DoD 8140 work role paths.
The CCP is the foundational CMMC certification. It has no experience requirement, and a CCP with a Tier 3 determination can join Level 2 assessment teams under CCA oversight, where the CCA makes all final determinations. The CCA is the next step and lets you conduct the assessment. The exams differ too: the CCP is 170 questions in 3.5 hours across six domains, and the CCA is 150 questions in four hours across four.
Lead CCA is a designation that sits on top of the CCA. 32 CFR 170.11 requires five years of cybersecurity experience, five years of management experience, three years of assessment or audit experience, and a qualification at the Advanced level for work role 612. Through ISACA you also need an active CCP and CCA, a Tier 3 determination and a US$500 application fee. The designation carries a US$500 annual fee and no extra CPEs.
The CCA's requirements did not change. On July 13, 2026, the Department of War suspended Phase 2, which was set to begin November 10, 2026 and would have brought C3PAO certification into applicable contracts as a condition of award. It also created a CMMC Reform Task Force. Phase 1 and 32 CFR Part 170, which defines the CCA, remain in effect. Check the DoW CIO's CMMC page for the current status.
ISACA's 2026 CCP and CCA Exam Candidate Guide and the CCA exam content outline describe the current exam: four domains, 150 questions, four hours. ISACA says the exam aligns directly to the approved training material Approved Training Providers deliver today, and that an updated curriculum is expected in or around the first quarter of 2027. Candidates who certify on the current material must also complete ISACA's Delta Training, which can be done after the exam.
Whether you're weighing the certification, sorting out the prerequisites, or planning training for an assessment team, tell us where you are and we'll help you map out the right path.