CMMC Assessor Credential Sets Training, Experience and Security Requirements

A guide updated October 29, 2026, details the requirements for earning the Certified CMMC Assessor (CCA) credential, which qualifies personnel to conduct CMMC Level 2 assessments within certified third-party assessment organizations (C3PAOs). The credential sits above the CMMC Certified Professional (CCP) certification in the assessor pathway. For contractors working toward CMMC readiness, the qualification rules matter not only as individual career requirements, but also as a factor in the availability and staffing of assessment teams.

The requirements are administered across several organizations. ISACA, acting as the CMMC Assessor and Instructor Certification Organization (CAICO), manages course approval, the exam, fees and certification maintenance. The Cyber AB, the CMMC accreditation body, oversees ecosystem requirements including the Code of Professional Conduct, Individual Service Agreement, experience attestations and approved training provider process. The Department of War (DoW) is identified as the source of the Tier 3 determination required for certification. The source describes these responsibilities separately, so candidates and employers should verify the relevant requirement with the organization that administers it.

Candidates must hold an active CCP and a certification listed under DoD 8140, complete mandatory CAICO-approved CCA training through a training provider listed on the Cyber AB Marketplace, pass a 150-question exam and submit an application demonstrating the required experience. The Cyber AB assessor page specifies three years of cybersecurity experience, one year of audit or assessment experience, and at least one baseline certification aligned with intermediate and/or advanced proficiency. ISACA also lists intermediate or advanced proficiency for the certified assessor career pathway (612) under DoD Manual 8140.3. A Tier 3 determination is required for the credential, but candidates do not need it before beginning training or sitting for the exam.

These rules have direct workforce-planning implications for C3PAOs and contractors. C3PAOs can use the criteria to identify candidates, structure development plans and anticipate when qualified assessors may be available for Level 2 work. Contractors should consider assessor capacity as part of assessment-readiness planning, rather than assuming that a qualified team can be scheduled on demand. Direct exam and application charges are $575 for ISACA members or $760 for non-members, plus a $50 application fee; those amounts are only part of the development effort, which also includes approved training, experience and credential prerequisites.

• Credential role: A CCA is the individual qualification for personnel conducting CMMC Level 2 assessments within a C3PAO.
• Prerequisite credential: Candidates need an active CMMC Certified Professional (CCP) certification and a certification from the DoD 8140 list.
• Training route: Candidates must complete the mandatory CAICO-approved CCA course through an approved training provider listed on the Cyber AB Marketplace.
• Experience threshold: The Cyber AB assessor page specifies three years of cybersecurity experience and one year of audit or assessment experience.
• Proficiency requirement: Candidates need at least one baseline certification aligned to intermediate and/or advanced proficiency, with the pathway identified as 612 under DoD Manual 8140.3.
• Exam and application costs: The 150-question exam costs $575 for ISACA members or $760 for non-members; the application fee is $50.
• Tier 3 timing: A DoW Tier 3 determination is required for certification, but the source says it is not required before training or the exam.
• C3PAO workforce planning: Use the requirements to map candidate readiness, qualification lead time and staffing capacity for Level 2 assessment work.
• Contractor readiness: Include assessor availability and scheduling in CMMC assessment plans, alongside the organization’s own preparation activities.
• Requirement ownership: ISACA/CAICO handles training approval, examination, fees and certification maintenance; The Cyber AB handles ecosystem requirements and experience attestation; DoW is the source of the Tier 3 determination.