How Long Does It Take to Become a Lead CCA?

For most people, the answer isn’t about courses at all. The training and exams on the way to Lead CMMC Certified Assessor take months. What decides when you can actually lead an assessment is the experience the CMMC rule requires, measured in years, and a government background investigation that runs on its own clock.

So the better question is how close you already are. Someone with a long career in cybersecurity, management and audit can move through the credential steps quickly. Someone early in their career will spend most of the time building the experience, and the credentials will be waiting when they get there.

The three rungs

There are three credentials on the path, and each one requires the one before it.

The rule sets the Lead CCA bar in one sentence: “at least 5 years of cybersecurity experience, 5 years of management experience, 3 years of assessment or audit experience, and at least one foundational qualification aligned to Advanced Proficiency Level” of the DoD’s Security Control Assessor (612) work role (32 CFR § 170.11(b)(10)). It sits inside the list of CCA requirements, so you have to be a CCA first.

Lead CCA is a designation, not another exam

There’s no Lead CCA course and no Lead CCA exam. ISACA, which certifies CMMC assessors as the CAICO, calls it the “Lead CMMC Certified Assessor Designation” and says CCAs “may choose to pursue a Lead CCA designation as a next step.” You apply, ISACA validates your experience, and you pay a US$500 application fee. Keeping it costs US$500 a year, with no separate continuing education requirement of its own, though your CCA’s still applies.

That’s why the experience matters so much. Once you have it, the designation is paperwork. Until you have it, no amount of training gets you there.

What a Lead CCA actually does

The designation exists because every assessment needs someone to run it. The rule requires every assessment team to include “a Lead CCA… and at least one other CCA” (§ 170.9(b)(12)), and the CMMC Assessment Process gives the lead the decisions that shape the engagement. The C3PAO proposes the Lead CCA to the client by name and screens them for conflicts (CAP P.14). In Phase 1, “the Lead CCA shall make the determination as to the readiness of the OSC to proceed” (CAP 1.10), which is the call that either opens the assessment week or suspends it. During the assessment the lead runs the team’s daily work, and at the end holds the out-brief, where the client hears the result for every requirement.

That’s also why Lead CCAs are the scarce credential in the ecosystem. As of September 2026 there were 681 of them for 117 C3PAOs (see how many C3PAOs there are), and every assessment on every calendar needs one.

Two clocks, and a third you don’t control

The credential clock is yours. Each course is four live sessions; you get a six-month window to sit each exam after registering. ISACA’s own pages give different deadlines for applying once you pass, anywhere from one year to five, so apply promptly rather than counting on the longest. If you take the CCP one month and the CCA the next, the training and exams themselves can fit into a season.

The experience clock may already be running. The preamble to the rule says the Lead CCA experience requirements “are cumulative.” It doesn’t say whether, say, years spent managing a security team can count toward both cybersecurity and management at once, so ask ISACA how it will validate your history before you assume. The rule asks for “assessment or audit experience” without limiting it to cybersecurity audits; DoD declined to narrow it.

The Tier 3 clock isn’t yours. Every CCA needs a favorable Tier 3 background determination, initiated on the SF-86, and the rule is clear it “will not result in a security clearance” (§ 170.11(b)(3)). There’s no published processing time for CMMC investigations, and the Cyber AB told its August 2026 Town Hall that “DCSA’s Tier 3 process is cumbersome and takes exceedingly long to adjudicate.” The good news is that you don’t have to wait for it to keep moving: ISACA says “CCA candidates do not need to have completed Tier 3 before they can take the CCA exam.”

The qualification people forget

Both the CCA and the Lead CCA need a DoD 8140.03 qualification for the Security Control Assessor role, at Intermediate for a CCA and Advanced for a Lead. The Cyber AB’s list as of September 2025 includes Security+, CGRC and GSEC at Intermediate, and CISA, CISM, CISSP, CySA+ and GSNA at Advanced, with the note that DoD may update it. If you’re aiming at Lead and don’t hold an Advanced-level certification yet, that exam is its own project, and it’s worth scheduling alongside the CMMC courses rather than after them.

Three people, three timelines

These are illustrations, not promises, because the experience validation is ISACA’s call:

1. A security manager with ten years in, a CISSP, and audit work behind them. The experience and the qualification are already there. The path is the two courses, two exams, the applications and the Tier 3, so the wait is mostly the investigation.
2. A systems administrator with four years of security work and Security+. They can become a CCA once they have a year of assessment or audit experience, which CCP work on assessment teams can help build. Lead is a few years out: the management years and an Advanced-level qualification are the gap.
3. Someone new to cybersecurity. The CCP has no experience requirement in the rule, so it’s a real first step, and it lets them work on assessments under a CCA. The CCA and Lead rungs follow the experience, years later.

While you climb, keep what you have

Credentials last three years from issuance (§ 170.11(b)(1)). The CCA needs at least 20 continuing education hours a year and 120 over three years, with an annual maintenance fee to ISACA of US$170, or US$90 for members. The full cost picture is in what the CCA really costs, and CCP vs. CCA covers what each credential lets you do.

Starting the clock

If the courses are the part you control, start them. Our CCP and CCA courses are taught live by instructors who assess for a living, in alternating months so you can go straight from one to the next.

Sources: 32 CFR Part 170, § 170.9(b)(12), § 170.11 and § 170.13; CMMC Program final rule, 89 FR 83092 (October 15, 2024), preamble at 83122; ISACA, CCP, CCA and LCCA credential and maintenance pages and CMMC FAQ (October 2026); the Cyber AB, assessor roles page and DoD 8140.03 qualification list (September 2025); Cyber AB Town Hall presentation, August 25, 2026.