What is the CCA difference?
A CMMC Certified Assessor (CCA) is the certification required to perform formal CMMC Level 2 certification assessments within the US Department of War’s (DoW) cybersecurity ecosystem. A CCA equips experienced cybersecurity professionals with the advanced skills needed to evaluate evidence, validate security controls, conduct interviews, and determine whether organizations handling Controlled Unclassified Information (CUI) meet CMMC Level 2 certification requirements.
CCA develops the advanced, job-ready skills required to perform official CMMC Level 2 assessments. Explore the CCA domains:
How do I become CCA certified?
Getting ready for the exam
You have two ways to prepare for the CCA exam. Begin right away with an ATP via the CyberAB Marketplace, or take ISACA’s self‑paced training when it launches in Q4 2026. Until then, ATP training is available now on the CyberAB Marketplace.
CCA Online Review Course (Coming Soon)
Prepare for the CCA certification exam with this online course that provides on-demand instruction and in-depth exam preparation.
CCA Questions, Answers & Explanation Database (Coming Soon)
Get a subscription to a comprehensive question pool of items. Build a custom study plan with a personalized dashboard, track progress and review previously answered questions.
CCA Review Manual | Digital Version (Coming Soon)
A comprehensive reference guide to prepare for the CCA certification exam.
CCA Review Manual | Print Version (Coming Soon)
Get a hard copy of the comprehensive reference guide to prepare for the CCA certification exam.
Before you register:
Register for the exam
CCA candidates must complete the mandatory CAICO-approved CCA course, and hold an active CCP certification and a certification from the 8140 list. Upon registration, CCA exam candidates have a twelve-month eligibility period to take their exam. This means that from the date you register, you have 12 months to take your CCA exam. It is important to note that the exam registration fee must be paid in full before an exam candidate can schedule and take an exam.
ISACA has a zero-tolerance policy for fraudulent test taking activities. Those involved in fraudulent activities will be subject to score nullification and/or certification revocation. Please see “Terms of Use – 16. Exams.”
Seamless certification journey
ISACA’S CCA certification exams are computer-based and administered at authorized PSI testing centers globally or as remotely proctored exams. CCA exam registration is continuous, meaning candidates can register any time, no restrictions. Candidates can schedule a testing appointment as early as 48 hours after payment of exam registration fees.
Log in to MyISACA or create an account to begin
If you are creating an account, please ensure your name matches what appears on your government-issued identification that you will present on the day of your CCA exam.
ISACA’s Zero-Tolerance Policy
ISACA has a zero-tolerance policy for fraudulent test-taking activities. Those involved in fraudulent activities will be subject to score nullification and/or certification revocation.
VIEW TERMS OF USE FOR EXAMSPlease note, CCA exam appointments are only available 90 days in advance. If you do not see your exam site or date available more than 90 days in advance, please check back when it is closer to your desired exam date. If you still do not see your desired exam site or date available, please verify that your CCA exam eligibility has not expired by logging into your ISACA Account, and clicking the Certification & CPE Management tab.
Rescheduling an exam
You can reschedule your CCA exam anytime, without penalty, during you eligibility period if done at least 48 hours before your scheduled testing appointment. To reschedule a testing appointment, log in to your MyISACA account and follow the rescheduling steps in the Scheduling Guide.
How to become certified
Taking and passing the CCA certification exam is just the first step in becoming certified. To become CCA certified, an individual must first meet the following requirements:
- Complete mandatory CCA training
- Pass the certification exam
- Hold an active CCP certification
- Pay the US$50 application processing fee >
- Submit application to demonstrate experience requirements
- Hold a tier 3 determination by the DoW
- One intermediate or advanced proficiency level for the career pathway certified assessor 612 from the DoD manual 8140.3 Cyberspace Workforce Qualification & Management Program
- Adhere to the Code of Professional Ethics >
- Adhere to the Continuing Professional Education Policy >
Candidates have two years from passing the exam to apply for CCA certification.
Why certify
ISACA’s CCA certification is globally validated and recognized
CCA gives you the credibility needed to move ahead in your career
Proves to employers that you’re ready to add value to their enterprise
Required for many organizations and government agencies
CMMC Delta Online Course
Delta training is only to complement the certification of CCP/CCAs. It is specific to correcting the CATM that was used to certify them. It isn’t for consumption by other stakeholders current on what has changed across the CMMC program. It distills recent rule updates, assessment process changes, and ecosystem terminology into a practical, digestible format so participants can confidently adjust their compliance and assessment preparation efforts.
Already certified and need to maintain your certification?
Related Credentials
