- Maps to CCA Domain 1, Evaluating Organizations Seeking Certification (OSC) Against CMMC Level 2 (15%).
- Review an organization’s readiness, documentation, and system security plan before an assessment.
- Confirm the organization understands its CUI and where it lives.
- Recognize when an organization is not ready to be assessed.
CMMC Certification Training
CMMC Certified Assessor™ (CCA™) Certification Training Course
Take the next step after CCP. Accumentum prepares active CMMC Certified Professionals for the CMMC Certified Assessor (CCA) exam, the credential required to perform formal CMMC Level 2 certification assessments.
Course focus: Evaluating organizations against CMMC Level 2, Level 2 scoping, the CMMC Assessment Process, and assessing Level 2 practices, mapped to the four CCA exam domains, for active CCPs moving into assessor work.
Course Overview
Move from assessment team member to the assessor who makes the call.
The CMMC Certified Assessor™ (CCA™) Certification Training Course with Accumentum prepares experienced professionals for the CCA exam. ISACA administers CCA as the CAICO and describes it as the certification required to perform formal CMMC Level 2 certification assessments for the Department of War.
CCA is not an entry credential. ISACA requires an active CCP, three or more years of cybersecurity experience, at least one year of assessment or audit experience, and an intermediate or advanced certification for the Certified Assessor 612 career pathway under DoD Manual 8140.03. ISACA’s CISA and CISM are two of the certifications that meet that baseline.
The eight modules follow ISACA’s four CCA domains: Evaluating Organizations Seeking Certification Against CMMC Level 2 (15%), CMMC Level 2 Assessment Scoping (20%), CMMC Assessment Process (25%), and Assessing CMMC Level 2 Practices (40%).
Accumentum is not a CMMC Approved Training Provider (ATP). ISACA requires CCA candidates to complete the mandatory CAICO-approved CCA course before they register for the exam. This course is exam preparation that sits alongside that training. It does not replace it.
Start here first: CMMC Certified Professional (CCP). CCA requires an active CCP. If you do not hold one yet, start with Accumentum’s CCP course.
Course Objectives
Build CCA exam readiness and Level 2 assessment judgment.
01
Evaluate an organization
Judge whether an organization seeking certification meets CMMC Level 2, using interviews, evidence review, and testing.
02
Scope a Level 2 assessment
Categorize CUI assets, security protection assets, and out-of-scope assets, and defend the scope you set.
03
Run the assessment process
Plan, conduct, and report a Level 2 assessment, and evaluate POA&M closeout under the CMMC Assessment Process.
04
Assess Level 2 practices
Apply assessment objectives to the 110 NIST SP 800-171 Revision 2 requirements and reach supportable findings.
Who Should Attend
- Active CCPs who want to perform formal CMMC Level 2 certification assessments.
- Auditors and assessors with a CISA, CISM, or other 8140 work role 612 certification who work with defense contractors.
- Compliance leads at C3PAOs and consulting firms building assessment teams.
- Professionals aiming for Lead CCA.
Prerequisites
- ISACA requires an active CCP. Accumentum’s CCP course covers that first step.
- ISACA requires three or more years of cybersecurity experience and at least one year of assessment or audit experience.
- ISACA requires one intermediate or advanced proficiency certification for the Certified Assessor 612 career pathway under DoD Manual 8140.03. CISA and CISM are two options.
- ISACA requires a Tier 3 determination from the DoW to certify. ISACA says CCA candidates do not need to finish Tier 3 before training and the exam.
Pathway Map
The CCA training course covers all four CCA domains across eight modules.
Every module opens with the exam domain it maps to, so you can see how the pieces fit together across the course.
Course Content
- Maps to CCA Domain 1, Evaluating Organizations Seeking Certification (OSC) Against CMMC Level 2 (15%).
- Apply the Code of Professional Conduct as the person who makes final determinations.
- Identify and manage conflicts of interest.
- Protect information you learn about an organization during an assessment.
- Maps to CCA Domain 2, CMMC Level 2 Assessment Scoping (20%).
- Categorize CUI assets, security protection assets, contractor risk managed assets, specialized assets, and out-of-scope assets.
- Evaluate enclaves, external service providers, and cloud services in scope.
- Document and defend a scope decision.
- Maps to CCA Domain 3, CMMC Assessment Process (CAP) (25%).
- Build the assessment plan and confirm readiness with the organization.
- Assign roles across the assessment team, including CCPs.
- Set evidence expectations before the assessment begins.
- Maps to CCA Domain 3, CMMC Assessment Process (CAP) (25%).
- Conduct the assessment and record findings.
- Prepare assessment results and handle disputes.
- Evaluate outstanding POA&M items and closeout.
- Maps to CCA Domain 4, Assessing CMMC Level 2 Practices (40%).
- Assess access control, identification and authentication, and audit and accountability requirements.
- Use examine, interview, and test methods to reach a finding.
- Judge whether evidence is adequate and sufficient.
- Maps to CCA Domain 4, Assessing CMMC Level 2 Practices (40%).
- Assess configuration management, media protection, maintenance, and incident response requirements.
- Evaluate inherited controls from external service providers.
- Write findings that hold up to review.
- Maps to CCA Domain 4, Assessing CMMC Level 2 Practices (40%).
- Assess system and communications protection, system and information integrity, risk assessment, and security assessment requirements.
- Test practices that depend on technical configuration.
- Reconcile findings across families before the final determination.
Course Features
Designed for active CCPs preparing for the CCA exam.
Instructor-Led Sessions
Live virtual sessions focused on the decisions an assessor makes during a Level 2 assessment.
Assessment Scenarios
Case studies that ask what a CCA should find, document, or escalate.
Domain-Mapped Materials
Study materials organized by ISACA’s four CCA domains and their published weights.
Exam Readiness Review
Review of the exam structure, domain coverage, and scenario-style questions before you schedule.
Certification Exam
Prepare for the CMMC Certified Assessor exam.
CCA Exam Readiness
Accumentum’s CCA course prepares active CCPs to scope, run, and judge CMMC Level 2 assessments across all four CCA domains.
ISACA administers the CCA exam as the CAICO for the Department of War’s CMMC program. ISACA describes CCA as the certification required to perform formal CMMC Level 2 certification assessments.
The CCA exam has 150 multiple-choice questions and runs 4 hours. It covers four domains: Evaluating Organizations Seeking Certification Against CMMC Level 2 (15%), CMMC Level 2 Assessment Scoping (20%), CMMC Assessment Process (25%), and Assessing CMMC Level 2 Practices (40%).
To register for the exam, ISACA requires the mandatory CAICO-approved CCA course, an active CCP, and a certification from the 8140 list. Exams are computer-based and taken at PSI testing centers or through remote proctoring. After you register, you have six months to take the exam.
To become certified you must also show three or more years of cybersecurity experience and at least one year of assessment or audit experience, pay ISACA’s application processing fee, hold a Tier 3 determination from the DoW, and follow ISACA’s Code of Professional Ethics and CPE policy.
CMMC program status: the first phase began on November 10, 2025. On July 13, 2026, the Department of War suspended Phase II and started a review of the program. Phase 1 self-assessment requirements remain in place. Check the DoW CIO CMMC page for current status before you plan around a deadline.
Accumentum is an independent training provider. ISACA sets and changes exam rules, fees, and policies, so confirm current details on isaca.org before you register.
Frequently Asked Questions
How Accumentum’s CCA course lines up with the exam, who is eligible, and what ISACA requires after you pass.
CCA is the certification ISACA says is required to perform formal CMMC Level 2 certification assessments for the Department of War. A CCA evaluates evidence, validates controls, conducts interviews, and decides whether an organization meets Level 2.
Yes. ISACA requires an active CCP to register for the CCA exam and to certify. Accumentum’s CCP course covers that first step.
ISACA requires at least one intermediate or advanced proficiency certification for the Certified Assessor 612 career pathway under DoD Manual 8140.03. ISACA’s CISA and CISM are two of the certifications that meet it.
ISACA requires three or more years of cybersecurity experience and at least one year of assessment or audit experience.
Yes, to certify. ISACA requires a Tier 3 determination from the DoW, but says CCA candidates do not need to complete Tier 3 before training and the exam.
No. Accumentum is not a CMMC Approved Training Provider. ISACA requires the mandatory CAICO-approved CCA course. This course is exam preparation that sits alongside it.
Four domains: Evaluating Organizations Seeking Certification Against CMMC Level 2 (15%), CMMC Level 2 Assessment Scoping (20%), CMMC Assessment Process (25%), and Assessing CMMC Level 2 Practices (40%). The exam has 150 multiple-choice questions in 4 hours.
Phase 1 began on November 10, 2025, and its self-assessment requirements remain in place. On July 13, 2026, the Department of War suspended Phase II, which would have expanded third-party assessments, and started a review of the program. Check the DoW CIO CMMC page for current status.
The course is delivered as live virtual instructor-led training with assessment scenarios, case discussions, and study materials mapped to the four CCA domains.
No. You earn CCA by meeting all of ISACA’s requirements, including the CAICO-approved course, the exam, experience, the 8140 certification, and the Tier 3 determination. Accumentum is an independent training provider.
Enrollment
Enroll in the CMMC Certified Assessor (CCA) Certification Training Course with Accumentum.
Enroll in the CMMC Certified Assessor™ (CCA™) Certification Training Course with Accumentum to prepare for the CCA exam.
You will work through all four CCA domains with an instructor and practice the scoping, evidence, and finding decisions an assessor makes.
Before you enroll, confirm that you hold an active CCP and an 8140 work role 612 certification such as CISA or CISM, since ISACA requires both to sit the exam. For course dates and enrollment help, visit Accumentum’s registration page.
Lead CMMC Level 2 assessments with CCA training.
Prepare for the CCA exam while you build the scoping, evidence, and judgment skills an assessor needs.