- Maps to CCA Domain 1, Evaluating Organizations Seeking Certification (OSC) Against CMMC Level 2 (15%).
- Review an organization’s readiness, documentation, and system security plan before an assessment.
- Confirm the organization understands its CUI and where it lives.
- Recognize when an organization is not ready to be assessed.
CMMC Certification Training
CMMC Certified Assessor™ (CCA™) Certification Training Course
Take the next step after CCP. Accumentum prepares active CMMC Certified Professionals for the CMMC Certified Assessor (CCA) exam, the credential required to perform formal CMMC Level 2 certification assessments.
Course focus: Evaluating organizations against CMMC Level 2, Level 2 scoping, the CMMC Assessment Process, and assessing Level 2 practices, mapped to the four CCA exam domains, for active CCPs moving into assessor work.
Course Overview
Move from assessment team member to the assessor who makes the call.
The CMMC Certified Assessor™ (CCA™) Certification Training Course with Accumentum prepares experienced professionals for the CCA exam. ISACA administers CCA as the CAICO and describes it as the certification required to perform formal CMMC Level 2 certification assessments for the Department of War.
CCA is not an entry credential. ISACA requires an active CCP, three or more years of cybersecurity experience, at least one year of assessment or audit experience, and an intermediate or advanced certification for the Certified Assessor 612 career pathway under DoD Manual 8140.03. ISACA’s CISA and CISM are two of the certifications that meet that baseline.
The eight modules follow ISACA’s four CCA domains: Evaluating Organizations Seeking Certification Against CMMC Level 2 (15%), CMMC Level 2 Assessment Scoping (20%), CMMC Assessment Process (25%), and Assessing CMMC Level 2 Practices (40%).
Accumentum is not a CMMC Approved Training Provider (ATP). ISACA requires CCA candidates to complete the mandatory CAICO-approved CCA course before they register for the exam. This course is exam preparation that sits alongside that training. It does not replace it.
Start here first: CMMC Certified Professional (CCP). CCA requires an active CCP. If you do not hold one yet, start with Accumentum’s CCP course.
Course Objectives
Build CCA exam readiness and Level 2 assessment judgment.
01
Evaluate an organization
Judge whether an organization seeking certification meets CMMC Level 2, using interviews, evidence review, and testing.
02
Scope a Level 2 assessment
Categorize CUI assets, security protection assets, and out-of-scope assets, and defend the scope you set.
03
Run the assessment process
Plan, conduct, and report a Level 2 assessment, and evaluate POA&M closeout under the CMMC Assessment Process.
04
Assess Level 2 practices
Apply assessment objectives to the 110 NIST SP 800-171 Revision 2 requirements and reach supportable findings.
Who Should Attend
- Active CCPs who want to perform formal CMMC Level 2 certification assessments.
- Auditors and assessors with a CISA, CISM, or other 8140 work role 612 certification who work with defense contractors.
- Compliance leads at C3PAOs and consulting firms building assessment teams.
- Professionals aiming for Lead CCA.
Prerequisites
- ISACA requires an active CCP. Accumentum’s CCP course covers that first step.
- ISACA requires three or more years of cybersecurity experience and at least one year of assessment or audit experience.
- ISACA requires one intermediate or advanced proficiency certification for the Certified Assessor 612 career pathway under DoD Manual 8140.03. CISA and CISM are two options.
- ISACA requires a Tier 3 determination from the DoW to certify. ISACA says CCA candidates do not need to finish Tier 3 before training and the exam.
Pathway Map
The CCA training course covers all four CCA domains across eight modules.
Every module opens with the exam domain it maps to, so you can see how the pieces fit together across the course.
Course Content
- Maps to CCA Domain 1, Evaluating Organizations Seeking Certification (OSC) Against CMMC Level 2 (15%).
- Apply the Code of Professional Conduct as the person who makes final determinations.
- Identify and manage conflicts of interest.
- Protect information you learn about an organization during an assessment.
- Maps to CCA Domain 2, CMMC Level 2 Assessment Scoping (20%).
- Categorize CUI assets, security protection assets, contractor risk managed assets, specialized assets, and out-of-scope assets.
- Evaluate enclaves, external service providers, and cloud services in scope.
- Document and defend a scope decision.
- Maps to CCA Domain 3, CMMC Assessment Process (CAP) (25%).
- Build the assessment plan and confirm readiness with the organization.
- Assign roles across the assessment team, including CCPs.
- Set evidence expectations before the assessment begins.
- Maps to CCA Domain 3, CMMC Assessment Process (CAP) (25%).
- Conduct the assessment and record findings.
- Prepare assessment results and handle disputes.
- Evaluate outstanding POA&M items and closeout.
- Maps to CCA Domain 4, Assessing CMMC Level 2 Practices (40%).
- Assess access control, identification and authentication, and audit and accountability requirements.
- Use examine, interview, and test methods to reach a finding.
- Judge whether evidence is adequate and sufficient.
- Maps to CCA Domain 4, Assessing CMMC Level 2 Practices (40%).
- Assess configuration management, media protection, maintenance, and incident response requirements.
- Evaluate inherited controls from external service providers.
- Write findings that hold up to review.
- Maps to CCA Domain 4, Assessing CMMC Level 2 Practices (40%).
- Assess system and communications protection, system and information integrity, risk assessment, and security assessment requirements.
- Test practices that depend on technical configuration.
- Reconcile findings across families before the final determination.
Course Features
Designed for active CCPs preparing for the CCA exam.
Expert-Led Sessions
Live virtual sessions focused on the decisions an assessor makes during a Level 2 assessment.
Assessment Scenarios
Case studies that ask what a CCA should find, document, or escalate.
Domain-Mapped Materials
Study materials organized by ISACA’s four CCA domains and their published weights.
Exam Readiness Review
Review of the exam structure, domain coverage, and scenario-style questions before you schedule.
Certification Exam
Prepare for the CMMC Certified Assessor exam.
CCA Exam Readiness
Accumentum’s CCA course prepares active CCPs to scope, run, and judge CMMC Level 2 assessments across all four CCA domains.
ISACA administers the CCA exam as the CAICO for the Department of War’s CMMC program. ISACA describes CCA as the certification required to perform formal CMMC Level 2 certification assessments.
The CCA exam has 150 multiple-choice questions and runs 4 hours. It covers four domains: Evaluating Organizations Seeking Certification Against CMMC Level 2 (15%), CMMC Level 2 Assessment Scoping (20%), CMMC Assessment Process (25%), and Assessing CMMC Level 2 Practices (40%).
To register for the exam, ISACA requires the mandatory CAICO-approved CCA course, an active CCP, and a certification from the 8140 list. Exams are computer-based and taken at PSI testing centers or through remote proctoring. After you register, you have six months to take the exam.
To become certified you must also show three or more years of cybersecurity experience and at least one year of assessment or audit experience, pay ISACA’s application processing fee, hold a Tier 3 determination from the DoW, and follow ISACA’s Code of Professional Ethics and CPE policy.
CMMC program status: the first phase began on November 10, 2025. On July 13, 2026, the Department of War suspended Phase II and started a review of the program. Phase 1 self-assessment requirements remain in place. Check the DoW CIO CMMC page for current status before you plan around a deadline.
Accumentum is an independent training provider. ISACA sets and changes exam rules, fees, and policies, so confirm current details on isaca.org before you register.
Exam Blueprint
Every CCA domain, in ISACA's words.
ISACA's CCA exam content outline has 4 job practice domains and 6 task statements. We've copied each one below exactly as ISACA lists it, with its weight.
Domain 1: Evaluating Organizations Seeking Certification (OSC) Against CMMC Level 2 (15%)
- A. Assess the various environmental considerations of Organizations Seeking Certification (OSCs) against CMMC Level 2 practices.
Domain 2: CMMC Level 2 Assessment Scoping (20%)
- A. Analyze the CMMC assessment scope of Controlled Unclassified Information (CUI) assets as they pertain to a CMMC assessment using the five categories of CUI assets as defined in the CMMC Level 2 Assessment Scoping Guide.
- B. Given a scenario, analyze the CMMC assessment scope based on the redetermined CUI categories within the CMMC Level 2 Assessment Scoping Guide.
- C. Evaluate the CMMC assessment scope considerations based on the CMMC Level 2 Assessment Scoping Guide.
Domain 3: CMMC Assessment Process (CAP) (25%)
- A. Given a scenario, apply the appropriate phases and steps to plan, prepare, conduct, and report on a CMMC Level 2 Assessment.
Domain 4: Assessing CMMC Level 2 Practices (40%)
- A. Identify evidence verification/validation methods and objects for practices based on the CMMC Level 2 Assessment Guide and CMMC Assessment Process (CAP) documentation.
Who It Is For
Is CCA the right fit for you?
ISACA says CCA benefits IT and security practitioners transitioning into compliance, government contractors and defense industry personnel, risk, audit and compliance professionals, and aspiring lead CCAs. It's the certification required to perform formal CMMC Level 2 certification assessments.
Here's what ISACA requires before you're certified. Passing the exam is only one of the steps.
ISACA's CCA certification requirements
- Complete mandatory CCA training
- Pass the certification exam
- Hold an active CCP certification
- Pay the US$50 application processing fee
- Submit application to demonstrate experience requirements
- Hold a tier 3 determination by the DoW
- One intermediate or advanced proficiency level for the career pathway certified assessor 612 from the DoD manual 8140.3 Cyberspace Workforce Qualification & Management Program
- Adhere to the Code of Professional Ethics
- Adhere to the Continuing Professional Education Policy
Exam Format
How the CCA exam works.
Exam details
- Questions: 150 multiple choice
- Length: 4 hours
- Language: English
- Delivery: PSI testing centers or remote proctoring
- Exam fee: US$575 for ISACA members, US$760 for non-members
- Application processing fee after you pass: US$50
- Eligibility: six months from registration
ISACA's outline leans on scenario questions. Several task statements open with "Given a scenario," so you'll be asked to apply the source documents to a situation, not just recall them.
We don't quote a passing score here. ISACA sets the scoring rules for its exams, and we point you to its candidate guide for the current details.
Study Plan
How we prepare you for CCA.
We start with Evaluating Organizations Seeking Certification (OSC) Against CMMC Level 2. It's 15% of the exam, so we work its task statements against the CMMC source documents with evidence scenarios.
Next we cover CMMC Level 2 Assessment Scoping. It's 20% of the exam, so we work its task statements against the CMMC source documents with evidence scenarios.
Then we move to CMMC Assessment Process (CAP). It's 25% of the exam, so we work its task statements against the CMMC source documents with evidence scenarios.
We wrap up with Assessing CMMC Level 2 Practices. It's 40% of the exam, so we work its task statements against the CMMC source documents with evidence scenarios.
Assessing CMMC Level 2 Practices carries the most weight at 40%, so it gets the most review time. In the last week we run timed practice at the real pace and reread the outline line by line. Remember that our course is exam prep. It sits alongside the mandatory training from an Approved Training Provider on the CyberAB Marketplace, and it doesn't replace it.
Exam Policies
Scheduling and certification rules for CCA.
Exam registration is continuous, so you can register at any time. You can schedule a testing appointment as early as 48 hours after you pay, and appointments open only 90 days in advance.
You can reschedule without penalty during your eligibility period if you do it at least 48 hours before your appointment.
After you pass, you have five years to apply for CCA certification.
ISACA has a zero-tolerance policy for fraudulent test taking, and those involved face score nullification or certification revocation. The name on your ISACA account has to match your government-issued ID.
Career Outlook
Where CCA can take you.
CCA is aimed at people who lead formal CMMC Level 2 assessments. BLS doesn't track CMMC roles separately, so we use the closest occupation as a reference.
Per the U.S. Bureau of Labor Statistics, information security analysts earned a median annual wage of $129,180 in May 2025. BLS also projects employment of information security analysts to grow 21 percent from 2025 to 2035, much faster than the average for all occupations. Treat it as a reference point and not a promise. Location, experience and the employer drive what any one person earns. Source: BLS Occupational Outlook Handbook.
Funding
Ways to pay for CCA training.
Paying on your own? CCA prep is eligible for PathPay, our monthly payment plan. Terms of 3, 4 and 6 months carry no added fee. 9, 12 and 18 month terms add 5%, 10% and 15%. Course access opens when your first payment clears.
Our funding page lists every other way to pay, and you can always talk with us or email info@accumentum.net before you enroll.
Frequently Asked Questions
How Accumentum’s CCA course lines up with the exam, who is eligible, and what ISACA requires after you pass.
CCA is the certification ISACA says is required to perform formal CMMC Level 2 certification assessments for the Department of War. A CCA evaluates evidence, validates controls, conducts interviews, and decides whether an organization meets Level 2.
Yes. ISACA requires an active CCP to register for the CCA exam and to certify. Accumentum’s CCP course covers that first step.
ISACA requires at least one intermediate or advanced proficiency certification for the Certified Assessor 612 career pathway under DoD Manual 8140.03. ISACA’s CISA and CISM are two of the certifications that meet it.
ISACA requires three or more years of cybersecurity experience and at least one year of assessment or audit experience.
Yes, to certify. ISACA requires a Tier 3 determination from the DoW, but says CCA candidates do not need to complete Tier 3 before training and the exam.
No. Accumentum is not a CMMC Approved Training Provider. ISACA requires the mandatory CAICO-approved CCA course. This course is exam preparation that sits alongside it.
Four domains: Evaluating Organizations Seeking Certification Against CMMC Level 2 (15%), CMMC Level 2 Assessment Scoping (20%), CMMC Assessment Process (25%), and Assessing CMMC Level 2 Practices (40%). The exam has 150 multiple-choice questions in 4 hours.
Phase 1 began on November 10, 2025, and its self-assessment requirements remain in place. On July 13, 2026, the Department of War suspended Phase II, which would have expanded third-party assessments, and started a review of the program. Check the DoW CIO CMMC page for current status.
The course is delivered as live virtual expert-led training with assessment scenarios, case discussions, and study materials mapped to the four CCA domains.
No. You earn CCA by meeting all of ISACA’s requirements, including the CAICO-approved course, the exam, experience, the 8140 certification, and the Tier 3 determination. Accumentum is an independent training provider.
ISACA lists US$575 for members and US$760 for non-members, plus a US$50 application processing fee once you pass.
Eligibility is good for six months from the date you register.
Yes, without penalty, as long as you do it at least 48 hours before your appointment and within your eligibility period.
ISACA gives you five years from passing the exam to apply.
Yes. CCA prep is eligible for PathPay. Terms of 3, 4 and 6 months add no fee, and longer terms add 5% to 15%.
Enrollment
Enroll in the CMMC Certified Assessor (CCA) Certification Training Course with Accumentum.
Enroll in the CMMC Certified Assessor™ (CCA™) Certification Training Course with Accumentum to prepare for the CCA exam.
You will work through all four CCA domains with an instructor and practice the scoping, evidence, and finding decisions an assessor makes.
Before you enroll, confirm that you hold an active CCP and an 8140 work role 612 certification such as CISA or CISM, since ISACA requires both to sit the exam. For course dates and enrollment help, visit Accumentum’s registration page.
Lead CMMC Level 2 assessments with CCA training.
Prepare for the CCA exam while you build the scoping, evidence, and judgment skills an assessor needs.