What Background-Check Tier Does a Lead CCA Need?

Short answer: Tier 3, the same background investigation every CMMC Certified Professional (CCP) and CMMC Certified Assessor (CCA) needs. There's no higher tier for a Lead CCA. The rule doesn't add one, and ISACA, which certifies assessors as the CAICO, lists the same “tier 3 determination by the DoW” for the Lead designation that it requires of every assessor.

So why does the question keep coming up? Usually because of two words: “Advanced 612.”

“Advanced 612” isn’t a background tier

On ISACA’s Lead CCA page, two requirements sit next to each other: hold “a tier 3 determination by the DoW,” and hold “one advanced proficiency level for the career pathway certified assessor 612.” Read quickly, the second sounds like a stronger version of the first. It isn’t. They come from different worlds.

The 612 is a work role, not a security level. The CMMC rule asks a Lead CCA for “at least one foundational qualification aligned to Advanced Proficiency Level of the DoD Cyberspace Workforce Framework’s Security Control Assessor (612) Work Role, from DoD Manual 8140.03” (32 CFR § 170.11(b)(10)). In practice that means a professional certification. ISACA’s Lead CCA application lists the ones it accepts: CISA, CISM, CySA+, CISSP, CISSP-ISSEP, GSLC, GSNA and CCISO.

Put the two requirements side by side across the three credentials and the difference is plain:

If you’re planning a path to Lead CCA, the background investigation is a box you tick once, early. The Advanced qualification is the one to plan for.

What Tier 3 actually is

The rule spells the investigation out in the same words for CCPs, CCAs and everyone on a C3PAO’s assessment team: “a Tier 3 background investigation resulting in a determination of national security eligibility” (§ 170.11(b)(3)). Three details in that paragraph answer most of the questions people ask.

It isn’t a clearance. The investigation “will not result in a security clearance and is not being executed for the purpose of government employment.” Passing it doesn’t give you access to classified information, and it doesn’t make you a federal employee.

It uses the clearance paperwork anyway. It’s “initiated using the Standard Form (SF) 86,” the Questionnaire for National Security Positions. Expect the same depth of questions about where you’ve lived, worked and traveled.

It’s set at moderate risk. CMMC assessor positions “are designated as non-critical sensitive with a risk designation of ‘Moderate Risk’” under the federal personnel rules (5 CFR 1400.201). DoD explained why in the rule’s preamble: “Based on the access to sensitive unclassified information, a Tier 3 background investigation… is required” (89 FR 83126). Assessors see a contractor’s security weaknesses before anyone else does.

The requirement isn’t limited to the credential holder’s own paperwork, either. A C3PAO has to require it of “all C3PAO company personnel participating in the Level 2 certification assessment process,” including “the CMMC Assessment Team and the quality assurance individual” (§ 170.9(b)(3)).

Who starts it, and when

You don’t file it on your own. The CMMC Program Management Office sponsors the Defense Counterintelligence and Security Agency (DCSA) investigations for ecosystem members (§ 170.6(d)), and the Cyber AB handles the hand-off. ISACA says the Cyber AB “will continue to run point on Tier 3 Investigations for CCPs and CCAs.”

The clock starts at the CCP stage. Per ISACA, “the background check process starts after you’ve completed CCP training, passed the CCP exam and applied for the certification,” when ISACA validates your experience and sends your information to the Cyber AB. That’s why most people have a determination long before they think about leading assessments.

Two practical points follow from that:

• It doesn’t hold up the CCA exam. ISACA is explicit: “CCA candidates do not need to have completed Tier 3 before they can take the CCA exam.” You need a favorable determination to hold the credential, not to sit the test. We cover the exam itself in how hard the CCA exam really is.
• It can’t be rushed. There’s no published processing time, and the Cyber AB told its August 2026 Town Hall that “DCSA’s Tier 3 process is cumbersome and takes exceedingly long to adjudicate.” An older Cyber AB FAQ (September 2024) says there’s no way to expedite it, though a current clearance “may expedite your application processing.”

What “or equivalent” means

The rule adds a second path: “Meet the equivalent of a favorably adjudicated Tier 3 background investigation when not eligible for a Tier 3 background investigation,” with “DoD” deciding the equivalence “for use with the CMMC Program only” (§ 170.11(b)(4)).

That path exists mainly for people who can’t apply for a US investigation, such as assessors who aren’t US citizens; the preamble points to DCSA’s international security assurance process for the details. It is not a fallback for a failed investigation. DoD was blunt about that: “not eligible” covers applicants who don’t meet the entrance requirements for a DCSA Tier 3, and “it is not an alternative for applicants who do not pass” (89 FR 83126).

What actually changes at the Lead level

If the background check stays the same, what does a CCA need to become a Lead? The rule’s list is short (§ 170.11(b)(10)):

• Experience: at least 5 years of cybersecurity experience, 5 years of management experience, and 3 years of assessment or audit experience.
• The Advanced 612 qualification described above, in place of the Intermediate one a CCA needs.

ISACA adds the administrative side: an active CCP and CCA, a US$500 application fee, an application that documents your experience, and its Code of Professional Ethics. There’s no separate Lead exam, and ISACA says “Lead CCAs do not need to report any additional CPE to maintain that credential.”

The experience is what takes the time. We map how long each piece usually takes in how long it takes to become a Lead CCA, and compare the two certifications underneath it in CCP vs. CCA.

The order that keeps you moving

Because the investigation starts with your CCP application and never needs repeating for the Lead designation, the practical order looks like this: apply for the CCP as soon as you’ve passed the exam, so the Tier 3 clock starts; take the CCA course and exam while it runs; and track your management and assessment years against the Lead thresholds as you go. If you already hold CISA, CISSP or one of the other Advanced certifications, you’ve covered the requirement people most often mistake for a background check.

Our CCP and CCA courses are taught live by instructors who assess for a living, and they’re a good place to start the clock.

Sources: 32 CFR Part 170, §§ 170.6(d), 170.9(b)(3), 170.11(b)(3), (4) and (10), 170.13(b)(3) and (4); 89 FR 83092 (October 15, 2024), preamble at 83126; 5 CFR 1400.201; ISACA, CMMC credentialing page and FAQ, Lead CMMC Certified Assessor page, and LCCA application form (checked November 2026); Cyber AB, Town Hall (August 2026); Cyber AB, FAQ for current CCPs and CCAs (September 25, 2024).