CMMC Certified Assessor
CCA is required to sit on a C3PAO assessment team. As of March 2026 there were 759 CCAs against roughly 25,500 assessments a year, each needing three.
What the CCA covers
Experienced cybersecurity practitioners who hold CCP and want to serve on assessment teams conducting CMMC Level 2 certification assessments.
ISACA publishes the blueprint below. The percentages are the share of the exam each area accounts for — not separate hurdles, since scoring is based on the total number of questions answered correctly.
| Content area | Weight | Lessons |
|---|---|---|
| Evaluating Organizations Seeking Certification (OSC) Against CMMC Level 2 | 15% | — |
| CMMC Level 2 Assessment Scoping | 20% | — |
| CMMC Assessment Process (CAP) | 25% | — |
| Assessing CMMC Level 2 Practices | 40% | — |
Try a question
No practice questions yet
The CCA blueprint is mapped and lessons are being written. The format and FAQ below are already sourced and current.
Format and logistics
- Delivery
- Proctored, computer-based (PSI)
- Fees
- USD 575 (ISACA member) · USD 760 (Non-member)
- Retakes
- Four attempts within a rolling 12-month period.
Where this comes from
Every figure above is taken from the documents below and checked against them on each build. Where ISACA’s own sources disagree with each other, the controlled document wins and the disagreement is recorded.
- ISACA CCA/CCP Exam Candidate Guide — © 2026 ISACA; PDF created 21 April 2026
CCA™ and CMMC® are marks of their respective owners. QualExam is an independent study resource and is not affiliated with, endorsed by, or sponsored by ISACA or the US Department of War.
By QualExam editorial. Written against the awarding body’s published blueprint and checked against it on every build.
Source: ISACA CCA/CCP Exam Candidate Guide
Last checked against the source: 2026-09-22