CCP vs CCA: CMMC assessor roles and requirements

The CMMC Certified Professional (CCP) and the CMMC Certified Assessor (CCA) are not alternatives. The CCA is built on the CCP: the CMMC rule requires every CCA to "be a CCP" first. So the real choice is whether to stop at the CCP or go on to the CCA, and that depends on what you want to do in a CMMC assessment. This comparison uses the rule itself, 32 CFR Part 170, and ISACA's 2026 candidate guide, which covers both certifications.

CCP vs CCA at a glance

What the rule says each one does

The CCP. Under 32 CFR 170.13, a CCP "completes rigorous training on CMMC and the assessment process to provide advice, consulting, and recommendations to their OSA clients." CCPs "are eligible to become CMMC Certified Assessors and can participate as a CCP on Level 2 certification assessments with CCA oversight where the CCA makes all final determinations."

The CCA. Under 32 CFR 170.11, "CCAs, in support of a C3PAO, conduct Level 2 certification assessments of OSCs", following NIST SP 800-171A, the assessment process in the rule and its scoping requirements. "A CCA may conduct Level 2 certification assessments and participate on a C3PAO Assessment Team."

The team they work on. A C3PAO's assessment team "must include at least two people: a Lead CCA, as defined in § 170.11(b)(10), and at least one other CCA. Additional CCAs and CCPs may also participate on an Assessment Team." A CCP can be on the team; the CCAs make up its required core.

ISACA's guide says the same in career terms. The CCP is "the foundational certification for anyone seeking to work within the implementation and assessment ecosystem", while the CCA is "the certification required to perform formal CMMC Level 2 assessments", equipping experienced professionals "to evaluate evidence, validate security controls, conduct interviews, and determine whether organizations handling Controlled Unclassified Information (CUI) meet CMMC Level 2 requirements."

The real difference: who decides

Both can sit in the room during a Level 2 certification assessment. The difference is judgment. A CCP participates "with CCA oversight where the CCA makes all final determinations", so the CCA decides whether each requirement is met. If your work is preparing organizations for assessment, advising them or implementing their controls, the CCP covers it. If you want to be the person making the assessment determinations, you need the CCA.

The lessons on the individuals in the CMMC ecosystem and the assessment team cover these roles as the CCP exam tests them.

What each certification requires

The CCP

Eligibility is a college degree in a cyber or information technical field, 2+ years of related experience or education, or 2+ years of equivalent experience (including military) in a cyber, IT or assessment field, together with the CCP class from an Approved Training Provider. After passing the exam, you pay a US$200 application fee, submit an application demonstrating your experience and complete a Tier 3 background investigation. How to become a CCP takes each step in order.

The CCA

The rule sets the bar in one sentence. A CCA must "be a CCP who has at least 3 years of cybersecurity experience, at least 1 year of assessment or audit experience, and at least one foundational qualification, aligned to at least the Intermediate Proficiency Level" of the Security Control Assessor (612) Work Role, from DoD Manual 8140.03 (32 CFR 170.11(b)(6)).

ISACA's CCA requirements follow from that:

• complete the mandatory CCA training;
• pass the CCA exam;
• hold an active CCP certification;
• pay the US$50 application processing fee;
• submit an application that demonstrates the experience requirements;
• hold a Tier 3 determination from the Department of War;
• hold one intermediate or advanced proficiency level for Work Role 612 under DoD Manual 8140.3;
• adhere to the Code of Professional Ethics and the CPE Policy.

You do not need to finish the Tier 3 investigation before the CCA exam. ISACA's answer is direct: "CCA candidates do not need to have completed Tier 3 before they can take the CCA exam."

The guide gives candidates one year from passing an exam to apply for certification. ISACA's CCA web page says five years, as its CCP page does. Plan around the guide, the controlled document.

The two exams compared

Both exams are multiple choice, closed book, in English, with a passing score of 450 on ISACA's 200 to 800 scale, and both cost US$575 for members or US$760 for nonmembers per attempt. They differ in length and in what they test:

The domains show the shift from knowing the program to assessing against it:

The CAP is a quarter of both exams, so what you learn about the four phases of the assessment process for the CCP carries straight into the CCA. The CCA then puts 40% of its weight on assessing Level 2 practices, and 20% on scoping against the CCP's 15%.

Beyond the CCA: Lead CCA

Every assessment team needs a Lead CCA. The rule sets a higher bar again: "at least 5 years of cybersecurity experience, 5 years of management experience, 3 years of assessment or audit experience", and a foundational qualification aligned to the Advanced Proficiency Level of the same 612 Work Role (32 CFR 170.11(b)(10)). ISACA's guide adds that a passing score on the CCA exam is a prerequisite to a CMMC Lead Assessor designation.

One rule only the CCA carries

A CCA working an assessment may only use the IT, cloud, cybersecurity services and end-point devices of the C3PAO engaged for that assessment. Assessors are prohibited from using any other IT, including personally owned devices, to process, store or transmit assessment reports or other assessment information, though evaluating evidence inside the organization's environment with its own tools is permitted (32 CFR 170.11(b)(7)).

What each costs, and keeping them

The exam fees are the same, US$575 or US$760 per attempt; the application fee is US$200 for the CCP and US$50 for the CCA. Both certifications are valid for 3 years and follow the same CPE Policy: 120 CPE hours per three-year period, at least 90 aligned with that certification's exam content outline. What the CCP exam costs lists every fee.

What about the Registered Practitioner?

The RP is often weighed against the CCP, and it is a different kind of thing. It is a designation from The Cyber AB, not a certification from the CAICO, and 32 CFR Part 170 does not define it. The exam outline describes RPs plainly: "RPs in the CMMC ecosystem provide advice, consulting, and recommendations to their clients. They are the implementers and consultants, but do not participate in Certified CMMC Assessments." The Cyber AB's page says the same from the other side: "Individuals holding any level of an RP designation can provide CMMC implementation consulting services to assist in identifying gaps and providing mitigation strategies for an OSC preparing for an assessment."

The Cyber AB's requirements grid gives the RP's terms: registration takes "Approximately 3 weeks, including background check", the fee is $600 for "Application, Training and Testing", and renewal is a "$500 Annual renewal fee"; the Registered Practitioner Advanced costs $1,000 with a $750 annual renewal and requires an active RP. There is no experience prerequisite in the grid, and no exam from ISACA.

So the RP is the consulting designation, and the CCP is the first certification on the assessor path, which also covers the consulting work. If you want to advise OSCs and never join an Assessment Team, the RP does that. If you want to take part in certification assessments, or go on to the CCA, only the CCP leads there.

Which should you take?

• Take the CCP and stop there if you prepare organizations for assessment, advise them, implement their controls, or want to take part in assessments without making the determinations. The guide's CCP audience includes OSC employees, IT and cybersecurity professionals, compliance officers, legal and contract professionals, managers, consultants, federal employees and candidate assessment team members.
• Go on to the CCA if you want to conduct Level 2 certification assessments for a C3PAO and you meet the experience bar: three years in cybersecurity, one in assessment or audit, and the 612 qualification.
• Aim for Lead CCA only with the management and assessment experience the rule requires.

Is the CCP worth it on its own? It is the foundational certification and the only route to the CCA and the CMMC Certified Instructor, because a passing CCP score is a prerequisite for both. Whether it pays for itself depends on your role. None of the program documents we cite publishes salary figures, so we do not quote any.

Start with the CCP

Whichever way you go, the CCP comes first. The CCP's first domain, CMMC Ecosystem, is open in full with a free account, its questions in the exam's format among them, with 1,166 in the course.