CMMC CCP vs. CCA: Which Certification, in What Order, and What It Takes

The CMMC Certified Professional (CCP) and the CMMC Certified Assessor (CCA) aren't competing certifications. They're two steps on the same path: every CCA is a CCP first. The real questions are what each one lets you do, what the CCA asks of you beyond the exam, and whether your role needs the second step at all.

What does each certification let you do?

Both credentials are certified by the CMMC Assessor and Instructor Certification Organization (CAICO), a role ISACA now holds, and both are defined in the CMMC rule itself.

A CCP "completes rigorous training on CMMC and the assessment process to provide advice, consulting, and recommendations" to organizations preparing for CMMC. CCPs can also take part in Level 2 certification assessments "with CCA oversight where the CCA makes all final determinations" (32 CFR § 170.13).

A CCA conducts Level 2 certification assessments "in support of a C3PAO," against the NIST SP 800-171A assessment objectives, and can serve on a C3PAO assessment team (32 CFR § 170.11).

What does it take to become a CCA?

Passing the CCA course and exam is only part of it. Under 32 CFR § 170.11(b), a CCA must:

• Be a CCP first.
• Have at least 3 years of cybersecurity experience and at least 1 year of assessment or audit experience.
• Hold at least one foundational qualification aligned to the Intermediate proficiency level of the DoD's Security Control Assessor (612) work role, under DoD Manual 8140.03.
• Complete a Tier 3 background investigation, initiated on the SF-86, or meet DoD's equivalent if they aren't eligible for one. The rule is explicit that this "will not result in a security clearance."

CCPs need the same Tier 3 investigation, so it's worth starting the paperwork early whichever course you take.

Once certified, a CCA works under strict rules: only the C3PAO's IT and devices for assessment work, immediate notice of any breach of assessment materials, and no sharing of anything learned about an organization outside that assessment.

What about Lead CCA?

A Lead CCA isn't a separate exam; it's a CCA who meets a higher experience bar. The rule sets it at 5 years of cybersecurity experience, 5 years of management experience, 3 years of assessment or audit experience, and a foundational qualification aligned to the Advanced proficiency level of the same 612 work role (32 CFR § 170.11(b)(10)). Lead CCAs run the assessment team.

The CCP teaches you how CMMC is assessed. The CCA lets you be the one assessing.

Is the CCP worth it?

For most people who work around CMMC, yes, but not for everyone. It's worth it if you:

• Advise organizations on CMMC, as a consultant, an MSP or MSSP, or a readiness lead. It gives you a structured command of the model, the assessment process, and scoping, and a credential clients can check.
• Want to assess. There's no CCA without it.
• Support a C3PAO. CCPs can take part in Level 2 assessments under a CCA.

It's harder to justify if your only goal is getting one company ready for its own assessment and you'll never advise or assess anyone else. The DoD's own assessment guides and an experienced readiness partner may get you there for less. Keep the upkeep in mind too: a Tier 3 investigation and an annual renewal fee.

What happens after the course?

The course is one step of several. The Cyber AB lays out the order on its assessor page:

1. Apply with the CAICO. Certification now runs through ISACA; you stay in good standing with it from here on.
2. Take the course from an Approved Training Provider. Exam access requires completing training through an approved provider.
3. Pass the CCP exam.
4. Get your Tier 3 determination. For the CCP, it follows the exam. The CAICO doesn’t run the investigation, and it can take a while, so file the paperwork as soon as you’re eligible.
5. For the CCA: with an active CCP, apply to the CAICO, take the CCA course, and pass the CCA exam. ISACA lets you sit the exam before your Tier 3 is done; certification needs a favorable Tier 3 plus the experience and DoD 8140.03 qualification the rule requires.

Recommended background for the CCP, per the Cyber AB: a college degree in a cyber or IT field, or about two years of related experience or education (military included), plus CompTIA A+ or equivalent knowledge and DoD CUI awareness training.

Keeping it. Certificates are valid for three years (32 CFR § 170.13), with an annual renewal fee to ISACA, the CAICO since April 2026: US$85 for the CCP and US$170 for the CCA, or US$45 and US$90 for ISACA members, plus 20 CPE hours a year. What the CCA costs, fee by fee has the full breakdown. And when DoD or the CAICO decides the CMMC program has changed significantly, CCPs and CCAs have to retrain and recertify (32 CFR § 170.10).

Planning beyond the CCP

If assessing is the goal, plan for both courses from the start: CCP first, then CCA, with your experience, your 8140.03 qualification, and the Tier 3 investigation lined up so nothing stalls between them. If you want to lead assessments one day, track your assessment and management years against the Lead CCA thresholds as you go.

And if you do both kinds of work, keep CMMC's independence rule in mind: an assessor can't take part in the certification assessment of an organization they've helped prepare for any CMMC assessment within the past three years (32 CFR § 170.8(b)(17)(ii)(G)).

How our courses run

We teach both courses live, with CCP and CCA running in alternating months, so you can move from one to the next without a long gap:

THE COURSE CALENDAR · CCP AND CCA ALTERNATE

CCPStep one

JanMarMayJulSepNov

CCAStep two

FebAprJunAugOctDec

Each courseFour live sessions, two hours each, Monday and Thursday evenings

Taught by1st Defense instructors who assess for a living

Each course is four live, instructor-led sessions of two hours, on Monday and Thursday evenings from 6:00 to 8:00 PM ET. Training is delivered through Shadowscape, an Approved Training Provider (ATP: a training organization approved to deliver the official CCP and CCA courses), and taught by 1st Defense instructors; our team has trained 75+ CCPs and CCAs so far.

Ready to start with the CCP?

The CCP is the first step whichever way you go. Pick your cohort above; if you already know you're headed for assessing, the bundle covers both courses. Want exact session dates first, or not sure which course fits your background? Ask us on the training page, and an instructor will get back to you.