CMMC CCA Training Cost: What You're Paying For

The price of a CCA course is the number everyone compares, and it's only part of what it costs to become a CMMC Certified Assessor (CCA). There are fees paid to the certification body, a prerequisite credential, a background investigation, and the upkeep once you're certified. Some of these changed in April 2026, when ISACA took over CMMC assessor certification. Here's the whole picture, with the published fees and what our own course includes.

Who you pay, and for what

Since April 2026, ISACA has served as the CMMC Assessor and Instructor Certification Organization (CAICO). ISACA said in April that "CAICO services fully transitioned to ISACA this month." It handles applications, exams and renewals. Training comes separately, from an Approved Training Provider (ATP) listed on the Cyber AB Marketplace. The ISACA CMMC FAQ puts it simply: "The candidate will need to take training with an Approved Training Provider (ATP) and pass the CCA exam."

So the cost of the CCA splits in two:

When you compare course prices, line them up the same way. A lower course price that leaves out the exam isn’t lower once you add US$760 back in.

What the fees add up to

The full path runs through the CMMC Certified Professional (CCP) first. ISACA’s published fees for each step, as of October 2026:

1. Apply for the CCP. US$200 application processing fee.
2. Take CCP training from an ATP. ISACA: “CCP candidates must complete mandatory CCP training through an ATP before they earn the CCP certification.”
3. Pass the CCP exam. US$760, or US$575 for members, unless your course includes it.
4. Apply for the CCA. US$50 application processing fee.
5. Take CCA training from an ATP, and pass the CCA exam. US$760, or US$575 for members, unless your course includes it.
6. Renew every year. US$170 for the CCA, or US$90 for members, due by January 1. ISACA also requires you to keep the CCP you applied with active (US$85, or US$45 for members).

ISACA has run the numbers itself. In announcing the transition, it put the three-year cost of holding both credentials at US$2,280 through ISACA, or US$2,105 with ISACA membership, against US$3,175 under the previous pricing. ISACA raised exam prices and said “annual renewal fees were lowered to offset the cost.” Those figures cover the certification fees, not training.

If you read older guides, you’ll see the Cyber AB’s former prices: different application and exam fees, and annual renewals of $250 for the CCP and $500 for the CCA. Those predate the move to ISACA.

The costs that aren’t on a price list

Beyond the course and ISACA’s fees, five more costs come with the CCA. Most of them are paid in time rather than money.

BEYOND THE COURSE · 5 MORE COSTSMONEYTIME

1. 01
   A qualifying credentialAt least one DoD 8140.03 qualification for the Security Control Assessor (612) work role, at the Intermediate level. If you don’t already hold one, that’s a separate exam and its own fee.32 CFR § 170.11(b)(6)Security+CGRCGSECCISSPCISA
   MoneyTime
2. 02
   The Tier 3 background investigationInitiated on the SF-86, and it “will not result in a security clearance.” It starts after CCP training, the CCP exam and your application, and you can sit the CCA exam before it’s done. File as soon as you’re eligible.32 CFR § 170.11(b)(3)SF-86
   Time
3. 03
   ExperienceAt least 3 years of cybersecurity experience and 1 year of assessment or audit experience. No course can sell you that, so check it before you pay for anything.32 CFR § 170.11(b)
   Time
4. 04
   RetakesFour attempts within a rolling 12 months, with 30 days before the second and 90 days before each one after that. Every attempt costs the full exam fee, so good preparation is the cheapest way through.ISACA Exam Candidate Guide
   MoneyTime
5. 05
   Continuing educationAt least 20 CPE hours a year, including two on the CMMC rules, and 120 over three years. Hours can count toward both the CCP and the CCA. Free sources exist, such as webinars and chapter meetings, but the hours are yours to find.ISACA CPE Policy
   Time

What to ask any training provider

• Is the exam voucher included, and for which exam?
• Is it live, and who teaches it? An instructor who assesses for a living can answer the questions the slides don’t.
• Do you get recordings to review before the exam?
• What happens after the last session, when your questions come up while you study?
• When is the next CCA course after the CCP? A long gap between them stretches the whole path.

Our courses and current prices

We teach both courses live, with the CCP and the CCA in alternating months, so you can go from one to the next without a long wait. Training is delivered through Shadowscape, an Approved Training Provider, and taught by 1st Defense instructors who assess for a living. Current prices, the next cohort for each course, and the bundle are below.

Not sure you meet the CCA requirements yet? Read CCP vs. CCA: which certification, in what order, and what it takes, or ask us on the training page and an instructor will get back to you.

Sources: ISACA, CCP and CCA credential pages, maintenance pages, CMMC FAQ, and Certification Exam Candidate Guide (fees as listed October 15, 2026); ISACA, “ISACA’s critical work of growing capacity across the CMMC ecosystem” (April 13, 2026); ISACA CCP and CCA CPE Policy (March 2026); the Cyber AB, Assessing and Certification roles page and DoD 8140.03 qualification list (September 2025); 32 CFR § 170.11.