What Is CMMC Certified Assessor (CCA)?

Overview

CMMC Certified Assessor (CCA) is a ISACA credential. CMMC CCA exam prep for active CCPs. Covers Level 2 evaluation, Level 2 scoping, the CMMC Assessment Process, and assessing Level 2 practices. This PathKey™ guide summarizes the domains, format, cost signals, eligibility, and renewal pattern so you can decide before you book. Accumentum is an Army CA and Air Force COOL Approved Vendor. We teach preparation for the ISACA exam. ISACA sets exam content, fees, and policies.

Accumentum is an Army CA and Air Force COOL Approved Vendor. We teach preparation for the ISACA exam. ISACA sets exam content, fees, and policies.

Who it is for

• Active CCPs who want to perform formal CMMC Level 2 certification assessments.
• Auditors and assessors with a CISA, CISM, or other 8140 work role 612 certification who work with defense contractors.
• Compliance leads at C3PAOs and consulting firms building assessment teams.

Exam domains

Weights follow the official outline.

1. 01

   Evaluating Organizations Seeking Certification

   Maps to CCA Domain 1, Evaluating Organizations Seeking Certification (OSC) Against CMMC Level 2 (15%), Review an organization’s readiness, documentation, and system security plan before an assessment, and Confirm the organization understands its CUI and where it lives.

2. 02

   Assessor Conduct and Independence

   Maps to CCA Domain 1, Evaluating Organizations Seeking Certification (OSC) Against CMMC Level 2 (15%), Apply the Code of Professional Conduct as the person who makes final determinations, and Identify and manage conflicts of interest.

3. 03

   Level 2 Assessment Scoping

   Maps to CCA Domain 2, CMMC Level 2 Assessment Scoping (20%), Categorize CUI assets, security protection assets, contractor risk managed assets, specialized assets, and out-of-scope assets, and Evaluate enclaves, external service providers, and cloud services in scope.

4. 04

   Plan and Prepare the Assessment

   Maps to CCA Domain 3, CMMC Assessment Process (CAP) (25%), Build the assessment plan and confirm readiness with the organization, and Assign roles across the assessment team, including CCPs.

5. 05

   Conduct, Report, and POA&M Closeout

   Maps to CCA Domain 3, CMMC Assessment Process (CAP) (25%), Conduct the assessment and record findings, and Prepare assessment results and handle disputes.

6. 06

   Assessing Access, Identity, and Audit Practices

   Maps to CCA Domain 4, Assessing CMMC Level 2 Practices (40%), Assess access control, identification and authentication, and audit and accountability requirements, and Use examine, interview, and test methods to reach a finding.

7. 07

   Assessing Configuration, Media, and Incident Practices

   Maps to CCA Domain 4, Assessing CMMC Level 2 Practices (40%), Assess configuration management, media protection, maintenance, and incident response requirements, and Evaluate inherited controls from external service providers.

8. 08

   Assessing System, Network, and Risk Practices

   Maps to CCA Domain 4, Assessing CMMC Level 2 Practices (40%), Assess system and communications protection, system and information integrity, risk assessment, and security assessment requirements, and Test practices that depend on technical configuration.

Exam format and cost

Questions

Confirm on the vendor site

Duration

Confirm on the vendor site

Format

Multiple choice and related item types (confirm on the vendor outline)

Passing score

Confirm the passing score on the vendor site

Cost

Confirm the current exam fee on the vendor site before you register

Delivery

Vendor-approved test center or online proctoring (confirm on the vendor site)

Languages

Confirm available languages on the vendor site

Experience and eligibility

ISACA requires an active CCP. CCP course covers that first step. ISACA requires three or more years of cybersecurity experience and at least one year of assessment or audit experience.

Renewal

Renewal rules for CMMC Certified Assessor (CCA) are set by ISACA. Many credentials use a multi-year cycle with continuing education, a renewal fee, or a newer exam. Confirm the current cycle on the vendor site.

Roles this credential fits

• Evaluating organizations against CMMC Level 2, Level 2 scoping, the CMMC Assessment Process, and assessing Level 2 practices, mapped to the four CCA exam domains, for active CCPs moving into assessor work.
• CMMC
• Teams standardizing on this credential for hiring or compliance

Official sources

• ISACA credentialing

Always confirm fees, dates, and eligibility on the vendor site before you register. Vendors change outlines and prices without notice.