thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Cyber AB · Governance, Risk & Privacy · Expert

CMMC Certified CMMC Assessor (CCA) exam guide

Exam CCA

The Certified CMMC Assessor (CCA) is qualified to perform CMMC Level 2 assessments of defense contractors as part of a C3PAO team. It is the senior practitioner credential in the CMMC ecosystem and is in high demand as CMMC Level 2 certification becomes a contract condition.

QuestionsSee official page
Time limitSee official page
Passing scoreSee official page
Exam fee$760 USD
Valid for3 years
DeliveryPSI test center or remotely proctored (administered by ISACA as the CMMC CAICO)

Format: Computer-based exam. Fee note: ISACA member price $575; CCA training from an Approved Training Provider required.

Who it's for

Experienced cybersecurity auditors and assessors who hold CCP and want to lead or perform CMMC Level 2 assessments.

What the exam covers

Evaluating Organizations Seeking Certification (OSC) Against CMMC Level 2—
CMMC Level 2 Assessment Scoping—
CMMC Assessment Process (CAP)—
Assessing CMMC Level 2 Practices—

A dash means the vendor does not publish a weight for that domain.

Eligibility & prerequisites

Required: Active CCP; CCA course from an Approved Training Provider; at least 3 years of cybersecurity experience and 1 year of assessment or audit experience; a DoD 8140.03 baseline certification for work role 612 (Security Control Assessor) at Intermediate or Advanced level, such as Security+, CISA, CISM or CISSP; favourable Tier 3 determination; U.S. citizenship.

Recommended: Hands-on NIST SP 800-171 assessment experience.

Keeping it active

Three-year cycle: 120 CPE (at least 20 per year), at least 90 related to the certification including two CMMC-specific, plus annual renewal fees.

Skills & careers

Skills it validates

  • Conducting CMMC Level 2 assessments
  • Examining, interviewing and testing evidence
  • Scoping OSC environments
  • Scoring practices against NIST SP 800-171A objectives
  • Writing assessment findings
  • Applying the CMMC Assessment Process

Job roles

CMMC AssessorLead Assessor (C3PAO)Cybersecurity AuditorIT Compliance AuditorGRC Consultant

DoD 8140

CCA itself is not a DoD 8140 baseline; candidates must already hold a DoD 8140.03 work role 612 (Security Control Assessor) Intermediate or Advanced qualifying certification. Open the DoD Workforce Navigator

Where it fits in your path

You are here

CMMC Certified CMMC Assessor (CCA)

Planning a degree too? See how this cert earns college credit in the College Credit Navigator.

Build my study plan

  1. Month 1: Confirm eligibility (CCP, experience, 8140 baseline cert) and start Tier 3 processing.
  2. Month 1: Complete CCA training with an ATP.
  3. Month 2: Practise assessing all 110 NIST SP 800-171 requirements using 800-171A objectives.
  4. Month 2: Review the CAP phases and scoping guidance; take practice questions and book.

Make it yours: pick your exam date and weekly hours. We'll split your time by domain weight and give you a printable plan.

Exam-day tips

  • Know assessment methods (examine, interview, test) and when each is sufficient.
  • Learn MET / NOT MET scoring rules and POA&M limits.
  • Scoping questions are tricky; revisit asset categories carefully.
  • Exam questions follow the CAP closely; study it as a step-by-step process.

Key terms for this exam

All 32 terms Study with thinQcards™

Frequently asked questions

How much does CCA cost?

Exam $575 (ISACA members) or $760, plus ATP training.

What experience do I need?

Three years of cybersecurity and one year of assessment or audit experience.

Which baseline cert qualifies?

A DoD 8140.03 work role 612 Intermediate or Advanced certification, such as Security+, CISA, CISM or CISSP.

Do I need to be a U.S. citizen?

Yes, according to The Cyber AB.

Is CCA in demand?

Yes; assessor capacity is a known bottleneck as CMMC Level 2 rolls out.

Official page: www.isaca.org. Reviewed November 2026. Vendors change fees and objectives, so confirm with the vendor before you book. Spot something out of date? Tell us.