With CMMC requirements now appearing in US defence contracts, the bottleneck for many suppliers is not the controls but the people qualified to prepare for and conduct assessments, and the rules for becoming one changed when ISACA took over certification of the assessor workforce. This guide explains the two core individual credentials in the CMMC ecosystem: the CMMC Certified Professional (CCP) and the CMMC Certified Assessor (CCA). It covers who does what in an assessment, the exam domains, training through Approved Training Providers, the Tier 3 background determination, the DoD 8140 baseline certification a CCA needs, fees, and renewal. It is for compliance leads in the defence industrial base, consultants, internal auditors and assessors planning a CMMC career. Facts come from ISACA, now the CMMC Assessor and Instructor Certification Organization (CAICO), and from The Cyber AB, the accreditation body, and were checked on 27 October 2026; both say some details are changing, so confirm on their pages before you book.
Key takeaways
- ISACA now certifies CMMC individuals. ISACA states it is the CAICO, authorised by The Cyber AB, and manages training, examinations and certification; The Cyber AB remains the accreditation body.
- The CCP supports, the CCA decides. CCPs can join Level 2 assessment teams but cannot make final determinations; CCAs conduct Level 2 assessments and make final compliance determinations.
- The CCP comes first. A CCA must hold an active CCP, a DoD 8140 baseline certification for Work Role 612 (Security Control Assessor) at Intermediate or Advanced level, and a Tier 3 determination before certification.
- Exams cost USD 575 for ISACA members and USD 760 for non-members. Add a USD 200 application fee for the CCP and USD 50 for the CCA; ISACA puts the three-year cost of both at USD 2,280, or USD 2,105 with membership.
- Renewal is 120 CPE in three years. At least 20 a year, with at least 90 certification-related, including two CPEs on CMMC rules each cycle.
Who the certification is for
CMMC is the US Department of Defense's programme for verifying that contractors protect Federal Contract Information and Controlled Unclassified Information. ISACA states that CMMC formal implementation began on 10 November 2025. For the model itself, see the NIST SP 800-171 and CMMC 2.0 Guide.
| Role | What it may do (ISACA and The Cyber AB) | Typical holder |
|---|---|---|
| CCP (CMMC Certified Professional) | Verify Level 1 practices and participate on Level 2 assessment teams; cannot make final determinations | Compliance and GRC leads in defence suppliers, consultants preparing organisations, junior assessors, IT and security managers in the defence industrial base |
| CCA (CMMC Certified Assessor) | Conduct Level 2 assessments as part of a C3PAO team and make final determinations; cannot assess an organisation they helped prepare | Experienced auditors and assessors working for a CMMC Third-Party Assessment Organization (C3PAO) |
| Lead CCA (LCCA) | A designation for CCAs, with separate prerequisites published by ISACA and The Cyber AB | Senior assessors |
| CCI (CMMC Certified Instructor) | The instructor credential, also issued by ISACA | Trainers at Approved Training Providers |
- Choose the CCP if: you work inside a supplier preparing for assessment, advise suppliers, or want to start on the assessor route.
- Choose the CCA if: you intend to assess for a C3PAO. Note that consulting and assessing the same organisation are incompatible.
- Consider other credentials if: you need a general audit or controls credential outside the defence sector. See the ISC2 CGRC Certification Guide and the CISA Certification Guide.
Exam format and domains
Format and delivery
| Item | What ISACA publishes (checked 27 October 2026) |
|---|---|
| Delivery | Computer-based, at PSI testing centres worldwide or remotely proctored |
| Scheduling | Continuous registration; schedule as early as 48 hours after payment; appointments open 90 days ahead |
| Rescheduling | Free if done at least 48 hours before the appointment, within the eligibility period |
| Eligibility period | Six months from registration |
| Time to apply after passing | Five years |
| Items, duration, passing score, weights | Not stated on the CCP or CCA pages; ISACA links an exam content outline for detail |
CCP exam domains
| Domain | What to expect |
|---|---|
| CMMC Ecosystem | The roles of the DoD, The Cyber AB, the CAICO, C3PAOs, Approved Training Providers, and individual credential holders |
| CMMC-AB Code of Professional Conduct (Ethics) | Professional conduct obligations, conflicts of interest and objectivity |
| CMMC Governance and Source Documents | The regulatory and programme documents behind CMMC, including the NIST requirements it draws on |
| CMMC Model Construct and Implementation Evaluation | Levels, domains and practices, and how to judge whether a practice is implemented |
| CMMC Assessment Process (CAP) | Phases of an assessment, evidence and roles |
| Scoping | Defining the assessment boundary and asset categories |
CCA exam domains
- Evaluating Organizations Seeking Certification (OSC) Against CMMC Level 2.
- CMMC Level 2 Assessment Scoping. See the CMMC Scoping Guide.
- CMMC Assessment Process (CAP).
- Assessing CMMC Level 2 Practices. See the CMMC 2.0 Level 2 Assessment Guide and the NIST SP 800-171A Rev 3 Assessment Guide.
The descriptions in the CCP table are our summary of each domain's name; use ISACA's exam content outline for the authoritative task list.
Where identity fits: Level 2 practices on access control and identification and authentication are where assessors spend much of their evidence time, and shared administrator accounts, service accounts and API keys in the CUI boundary are common gaps. Assessors should expect to ask how non-human accounts are inventoried, authenticated and reviewed. See the CUI Guide.
Prerequisites and experience
CCP
| Requirement | Source and detail |
|---|---|
| Training | Mandatory CCP training from an Approved Training Provider on the Cyber AB Marketplace (ISACA) |
| Exam and application | Pass the exam, submit an application and pay the USD 200 processing fee (ISACA) |
| Background | A positively adjudicated Tier 3 background investigation by the Department of War (ISACA); The Cyber AB also accepts an equivalent such as a NAC or other DoD-accepted clearance |
| Recommended background | A college degree in a cyber or IT field, or two or more years of related experience or education, or equivalent including military; CompTIA A+ or equivalent; DoD CUI Awareness Training (The Cyber AB, recommended rather than mandatory) |
| Ethics and CPE | Adhere to the Code of Professional Ethics and the CPE policy (ISACA) |
CCA
| Requirement | Source and detail |
|---|---|
| CCP | An active CCP certification (ISACA) |
| Training | Mandatory CCA training through a CAICO-approved course (ISACA) |
| DoD 8140 baseline | A certification from the DoD 8140 list at registration, meeting Intermediate or Advanced proficiency for Work Role 612 Security Control Assessor under DoD Manual 8140.03 (ISACA). The Cyber AB's list as of September 2025 includes, at Intermediate, CompTIA Security+, PenTest+, Cloud+, SecurityX/CASP+, ISC2 CGRC and GIAC GSEC; at Advanced, ISACA CISA and CISM, ISC2 CISSP, CompTIA CySA+, and GIAC GSLC and GSNA |
| Experience | At least three years of cybersecurity experience and one year of assessment or audit experience (The Cyber AB); ISACA validates experience at application |
| Tier 3 | Required before certification, but not before training or the exam (ISACA) |
| Citizenship | US citizenship required (The Cyber AB) |
| Independence | A CCA cannot assess an organisation they helped prepare for CMMC (The Cyber AB) |
Preparation plan
- Decide the target role (week 0): CCP only, or CCP then CCA. For the CCA, confirm your DoD 8140 baseline certification and your assessment or audit experience now; they gate the whole route.
- Start the background process early: the Tier 3 determination is needed before certification, and ISACA notes The Cyber AB runs Tier 3 investigations for CCPs and CCAs.
- Book ATP training (weeks 1 to 4): choose an Approved Training Provider from the Cyber AB Marketplace. ISACA says ATPs should deliver only the approved curriculum for now, with an updated curriculum expected around the first quarter of 2027, and that Delta Training is required for those certifying under the current curriculum (it can be completed after the exam).
- Read the source documents (weeks 2 to 6): the CMMC programme rule and assessment guides, NIST SP 800-171 and SP 800-171A, and the scoping guidance. Know where each requirement comes from.
- Practise scoping (weeks 5 to 7): take a sample network and classify assets into the CMMC asset categories; scoping is a domain in both exams.
- Practise assessment (CCA, weeks 7 to 10): for a sample of Level 2 requirements, decide what to examine, whom to interview and what to test, and what evidence makes a requirement met.
- Book and sit: eligibility runs six months from registration; reschedule at least 48 hours before the appointment to avoid losing it.
- Apply: submit the application and fee after passing; you have five years to apply.
Measuring readiness
- Source fluency: you can name the document that governs each part of the assessment process.
- Scoping accuracy: on a practice environment, your asset categories match a reviewer's.
- Evidence judgement (CCA): for practice requirements, you can state what evidence would be sufficient and why.
- Ethics: you can identify conflicts of interest in consulting and assessing scenarios.
Small vs large organisations: in a small supplier, a CCP often doubles as the person implementing controls; the credential helps them speak the assessor's language, but they cannot assess their own organisation. Larger suppliers and C3PAOs typically need several CCPs on assessment teams, led by CCAs.
Cost, renewal and continuing education
| Item | CCP | CCA |
|---|---|---|
| Exam registration (ISACA) | USD 575 members, USD 760 non-members | USD 575 members, USD 760 non-members |
| Application processing (ISACA) | USD 200 | USD 50 |
| Three-year total for CCP and CCA together (ISACA) | USD 2,280, or USD 2,105 with ISACA membership (previously USD 3,175) | |
| Annual renewal fee | ISACA says renewal fees were lowered but does not state the amount on the pages checked | |
| CPE per year | At least 20 | |
| CPE per three years | At least 120; at least 90 related to the certification, including two CMMC-rules CPEs per cycle; the other 30 related or general professional development | |
| Overlap with other ISACA credentials | CPE from other ISACA certifications can count if the activity qualifies for both | |
| Training | ATP course fees are set by each provider and are not included above | |
ISACA states that no renewal changes apply to renewals before 31 March 2026 and that changes for renewals from 1 April 2026 would be announced in advance. The Cyber AB's role page still shows older fee figures, so use ISACA's pages for current pricing.
Common failure patterns
- Using old ecosystem material: resources that describe The Cyber AB as the certifying body for individuals, or quote older fees, predate ISACA's CAICO role.
- Leaving Tier 3 to the end: certification waits on the background determination.
- Missing the 8140 baseline: candidates complete CCA training before checking that they hold a qualifying Work Role 612 certification.
- Treating CMMC as a checklist: both exams test scoping and assessment judgement, not just recall of the practices.
- Conflict of interest: planning to consult for and then assess the same organisation.
Where it fits on the career path
- Before it: CompTIA Security+ or an equivalent foundation; it also appears on the Work Role 612 Intermediate list for the CCA.
- Alongside it: CISA, CISM or CGRC, which can serve as the DoD 8140 baseline for the CCA and broaden audit and risk skills.
- After it: Lead CCA, or a move into C3PAO management or defence-sector GRC leadership.
- Related roles: see the GRC Analyst Career Guide and the DFARS 252.204-7012 Guide for the contract clauses suppliers must meet.
ISACA and The Cyber AB do not publish pass rates or salary figures on the pages checked, and we do not quote third-party estimates. For a wider comparison, see the Cybersecurity Certifications Guide.
Practitioner checklist
- Decide whether you need the CCP only or the full CCP to CCA route.
- For the CCA, confirm a Work Role 612 Intermediate or Advanced certification and three years of cyber plus one year of assessment experience.
- Start the Tier 3 background process early.
- Choose an Approved Training Provider from the Cyber AB Marketplace and plan for Delta Training.
- Read the CMMC source documents, NIST SP 800-171 and SP 800-171A before the exam.
- Practise scoping and evidence judgement on sample environments.
- Register with ISACA, book within the six-month eligibility period and apply after passing.
- Plan at least 20 CPE a year, including CMMC-rules CPE each cycle.
Standards and references
- ISACA: CMMC Credentials
- ISACA: CMMC Certified Professional (CCP)
- ISACA: CMMC Certified Assessor (CCA)
- The Cyber AB: Assessing and Certification Roles
- NIST: SP 800-171 Rev. 3 Protecting Controlled Unclassified Information
Related NHI Mgmt Group resources: Cybersecurity Certifications Guide · NIST SP 800-171 and CMMC 2.0 Guide · CMMC 2.0 Level 2 Assessment Guide · CMMC Scoping Guide