Contact us

Popular: CMMC CCP Boot Camp Bookstore Contract Vehicles

Call us443.561.1334 Email usinfo@edwps.com
Contact us

8865 Stanford Blvd., Suite 202, Columbia, MD 21045

Veterans & service members: thank you for your service. You qualify for a special training discount. Email us for your code

Cyber AB Approved Training Provider

CMMC CCA Training & Exam Prep

Train to become a CCACMMC Certified Assessor: the certification required to perform official CMMC Level 2 assessments. It requires an active CCP. in five days of live, online classes taught by working CMMC assessors.

  • Length5 days
  • FormatLive online
  • Hours9–5 ET
  • Tuition$3,545
Enroll in CCA Training (opens in a new tab)

See all CCA class dates Open the full catalog (opens in a new tab)

Live CCA Training Schedule

CCA Class Dates & Pricing

Every live class is online, Monday to Friday, 9 AM to 5 PM Eastern. You’ll need an active CCP before you sit for the CCA exam.

Your CCA Options

Look for the same picture in our learning portal to find the right course.

What You Need to Become a CCA

  • An active CCP certification
  • Completed CCA training from an approved provider, and a passing CCA exam score
  • At least 3 years of cybersecurity experience
  • At least 1 year of assessment or audit experience
  • A DoD 8140 qualificationAt least an intermediate proficiency level for the Certified Assessor role (612) under DoD Manual 8140.3. for the Certified Assessor role
  • A favorable Tier 3 background checkA federal background investigation, reviewed by the Department of War. You don’t need it before class or the exam, only before ISACA grants your CCA.

Good news: you can take CCA training and the exam before your Tier 3 comes back. From ISACA’s CCA Exam Candidate Guide (PDF, opens in a new tab) and the CMMC rule (32 CFR 170.11 (opens in a new tab)).

Training an assessment team? Ask about a private class. Other questions? Email training@edwps.com or call 443.561.1334.

Who CCA Training Is For

Who Should Take CCA Training?

Experienced professionals ready to go from understanding CMMC to assessing it.

  • Cybersecurity professionals reviewing assessment information together Future Assessors

    A strong fit for

    Future CMMC Certified Assessors

    CCPs with cybersecurity and audit experience who want to perform official Level 2 assessments.

    Learn to review evidence, interview staff, test practices, and decide whether each requirement is met, the way assessors do on a real C3PAOCertified Third-Party Assessment Organization: a company authorized by The Cyber AB to perform official CMMC Level 2 assessments. CCAs work for C3PAOs. assessment.

    Earn the credential that lets you conduct official Level 2 assessments.

    Check ISACA’s CCA requirements
  • Cybersecurity consultant meeting with company leaders Consultants

    A strong fit for

    CMMC Consultants and Readiness Advisors

    Registered Practitioners and consultants at RPOsRegistered Practitioner Organizations: companies registered with The Cyber AB to help clients prepare for CMMC. helping companies get ready for Level 2.

    See exactly how assessors examine scope, evidence, and interviews, so your clients aren’t surprised on assessment day.

    Prepare clients with an assessor’s eye.

    Train your whole team privately
  • In-house cybersecurity and compliance team working together Internal Leaders

    A strong fit for

    Cybersecurity and Compliance Leaders

    In-house IT, security, and compliance leaders at defense contractors facing a Level 2 assessment.

    Understand the assessment objectivesThe specific checks an assessor uses to decide if each practice is met. There are 320 of them for Level 2. and evidence assessors expect, so you can run a confident internal review before a C3PAO arrives.

    Walk into your assessment knowing what assessors will ask.

    Need outside help? See CMMC consulting

Not sure you’re ready for CCA?

CCA requires an active CCP and real-world experience. We’ll help you pick the right first step.

See CCA Class Dates Start with CCP instead

The CCA Certification Path

How to Become a CMMC Certified Assessor

Class, exam, application. Three organizations each handle one part. Here’s who does what, what it costs, and how long you have.

  1. With Edwards

    Train

    Take the required CCA class

    ISACA requires CCA training from an approved providerAn Approved Training Provider (ATP) listed on the Cyber AB Marketplace. Edwards is one.. You don’t need your Tier 3 to start class or take the exam.

    5 days live online

    See class dates

  2. With ISACA

    Register

    Sign up for the exam

    Pay in your MyISACAYour free ISACA account. Your name must match your government ID exactly, or you can’t test. account. You then have six months to take the exam. Need more time? A one-time extension is $75.

    $575 members · $760 non-members

    Register with ISACA (opens in a new tab)

  3. With PSI

    Test

    Take the exam

    Book as soon as 48 hours after you pay, up to 90 days out. Test at a PSI center or from home. You’ll see if you passed right away.

    4 hours · 150 questions

    See what’s on the exam (opens in a new tab)

  4. With ISACA

    Apply

    Apply for certification

    Show your experience, a Tier 3 determinationA favorable result on a federal Tier 3 background investigation, reviewed by the Department of War., and a DoD 8140 qualificationAt least an intermediate proficiency level for the Certified Assessor role (612) under DoD Manual 8140.3.. Apply within one year of passing.

    $50 application fee

    See how to apply (opens in a new tab)

Exam Day at a Glance

  • 30 MINArrive early at a test center. At home, you’ll scan your room and desk with your camera first.
  • 1 IDA current government photo ID with your signature, like a driver’s license or passport. Military and digital IDs aren’t accepted.
  • 2 BREAKSUp to 10 minutes each, with permission. The clock keeps running.
  • 0 ITEMSNo phone, notes, smartwatch, or even water at your desk.

Scores and Retakes

450 The passing scaled scoreISACA converts your number of correct answers to a 200 to 800 scale so every version of the exam is graded fairly. on a scale of 200 to 800. Wrong answers don’t count against you, so answer every question.

Didn’t pass? You get four tries in 12 months. Each retake is a new exam fee, and you wait between tries:

  • 30days before try 2
  • 90days before try 3
  • 90days before try 4

Read the Official Guide Before You Book

ISACA’s free CCP and CCA Exam Candidate Guide covers every rule: IDs, rescheduling, home testing, and what happens if you get sick on exam day.

CMMC Certified Assessor (CCA) logo

Every CCA starts with training.

Do step one with an Approved Training Provider rated 9.6 out of 10 by our students.

Start With Step One Ask the training team

Exam facts are from ISACA’s 2026 CCP and CCA Exam Candidate Guide. Fees, timelines, and requirements are set by ISACA and can change, so always confirm on isaca.org. ISACA and PSI names and logos belong to their owners and appear here only to show each organization’s role.

Edwards CCA Curriculum

What CCA Training Prepares You to Do

CCP teaches you how CMMC works. CCA teaches you how to assess it: plan the work, check the evidence, and make the call on every practice.

Pick Your Class Week Ask about the curriculum
  • 5days of live instruction
  • 150questions on the CCA exam
  • 4exam domainsOn the exam, a domain is a topic area worth a set share of the questions. The CCA exam has four.
  • 320assessment objectivesThe specific checks an assessor uses to decide if each Level 2 practice is met, from NIST SP 800-171A.

  • Plan an Assessment

    Work through planning and preparation under the CAPCMMC Assessment Process: the official playbook assessors follow, from planning through results and POA&M close-out., from the first scope review to the assessment plan.

    You’ll be able to lead the planning conversation with a company before day one.

  • Validate the Scope

    Check how a company sorted its systems into the five asset categoriesCUI Assets, Security Protection Assets, Contractor Risk Managed Assets, Specialized Assets, and Out-of-Scope Assets., and spot what’s missing.

    You’ll be able to confirm the boundary is right before you assess anything.

  • Examine, Interview, Test

    Use the three official assessment methodsExamine documents and records, interview the people responsible, and test that systems actually work as described. on real-world practice scenarios.

    You’ll be able to pick the right method for every practice.

  • Judge the Evidence

    Decide whether evidence is adequate and sufficientAdequate means the evidence fits the requirement. Sufficient means there’s enough of it to prove the practice is in place. to call a practice met or not met.

    You’ll be able to make findings that hold up to review.

  • Scoring and POA&Ms

    How Level 2 scoring works, which gaps can go on a POA&MPlan of Action and Milestones: a plan to fix remaining gaps. Only certain practices qualify, and they must be closed within 180 days., and when a company earns conditional status.

    You’ll be able to explain exactly where a company stands after the assessment.

  • Report the Results

    Write up findings and walk through how results reach the DoD through eMASSThe Department of Defense system where C3PAOs upload official CMMC assessment results..

    You’ll be able to deliver a clear, defensible assessment report.

What the CCA Exam Tests

150 multiple-choice questions in 4 hours, across four domains. You need a scaled score of 450 out of 800 to pass.

  • 40%Assessing CMMC Level 2 Practices
  • 25%CMMC Assessment Process (CAP)
  • 20%CMMC Level 2 Assessment Scoping
  • 15%Evaluating Companies Against Level 2

From ISACA’s official CCA Exam Content Outline (opens in a new tab).

Free CCA Study Resources

Want more practice? CCA Exam Practice Questions, $29.99 (opens in a new tab) · CMMC bookstore

CCA Training FAQ

CCA Questions, Answered

The things people ask us most before they sign up for CCA training.

Do I need my CCP before I take CCA training?

To become a CMMC Certified Assessor, you need an active CMMC Certified Professional (CCP) certification first. Most people finish CCP, then move on to CCA.

Not there yet? Start with CCP training.

What are the requirements to become a CCA?

Under the CMMC rule, a CCA needs an active CCP, a Tier 3 background checkA federal background investigation, the same level used for jobs that need a Secret clearance., at least 3 years of cybersecurity experience, at least 1 year of assessment or audit experience, and a DoD 8140 qualification for the Certified Assessor role. You also need to pass the CCA exam.

See the full list on ISACA’s CCA page (opens in a new tab).

What’s the difference between a CCP and a CCA?

A CCP can give CMMC advice and can help on Level 2 assessments, but only with a CCA overseeing the work. A CCA conducts Level 2 assessments for a C3PAOCertified Third-Party Assessment Organization: a company authorized to perform official CMMC Level 2 assessments. and makes the final call on whether each practice is met.

Is the CCA exam fee included in the class price?

No. The $3,545 covers five days of live training and your course materials. The CCA exam is paid separately to ISACA: $575 for ISACA members or $760 for non-members.

Do I need my Tier 3 before CCA training or the exam?

No. You can take CCA training and the exam while your Tier 3 is in progress. ISACA needs a favorable Tier 3 determination before it grants your CCA certification.

What’s on the CCA exam, and what score do I need?

150 multiple-choice questions in 4 hours. Scores run from 200 to 800, and you need 450 to pass. Wrong answers don’t count against you, so answer every question.

You’ll see if you passed on screen right away. Your official score arrives by email within 10 business days.

Can I take the CCA exam from home?

Yes. You can test at a PSI test center or online with a live remote proctor. At home, you’ll scan your room and desk with your camera before you start. Read ISACA’s Remote Proctoring Guide (PDF, opens in a new tab) first.

What if I need to reschedule or I fail?

You can reschedule for free up to 48 hours before your appointment. Inside 48 hours, you must test or lose your fee.

If you don’t pass, you get four tries in 12 months. You wait 30 days before your second try and 90 days before each try after that, and each try is a new exam fee.

Is the class live or self-paced?

Live. You learn online with an instructor for five days, so you can ask questions and work through scenarios in real time. Pick your week on the class schedule.

Should I wait because CMMC Phase 2 is paused?

Training, exams, and voluntary C3PAO assessments are still moving. When Phase 2 starts again, companies will need assessors, and certified CCAs will be ready first.

Read what the pause means.

How long does the CCA certification last?

Three years. After that, you renew to keep assessing.

Can my company send a group?

Yes. Email training@edwps.com with how many people and when, and we’ll help you plan it.

Student Experience

What Students Say About
Edwards CMMC Training

Real feedback from professionals who took our CCP and CCA courses and now use what they learned on the job.

  • 9.6/10Average student rating
  • 2,200+Students trained
  • 13CMMC assessors on our instructor team
See CCP Class Dates Open Full Catalog (opens in a new tab)

CCP Training Overview

See What Class Is Really Like

Experienced instructors, the approved curriculum, and real talk about how CMMC works in practice.
Ready to find a class? See upcoming CCP dates and pick the week that works for you.
See CCP dates

Student Feedback

Straight From the Classroom

Students say the practical guidance, experienced instructors, and real-world examples made the biggest difference.
Overall, the sharing of thoughts and ideas on how to apply and properly interpret the CMMC Practices and Objectives was the most valuable.
Kevin Base
Outstandingly informative course. By far the most notes I’ve ever taken based on the sheer amount of information provided.
John Britton
This was a good course and starting point. I also liked the connection to the original 110 practices and the differences among policy, procedure, and management.
Sonya Wickel
The first part that made this so amazing was the different experiences and insight that each of the three instructors provided. I haven’t been in a class quite like this.
John Hocking
The process was done really well. I have a much better perspective on what I need to put together and how the policies, processes, and plans should look.
Matt Katzer
The perspectives of the different instructors were valuable, especially those who had already been through the DIBCACThe DoD team that assesses defense contractors’ cybersecurity. Its full name is the Defense Industrial Base Cybersecurity Assessment Center. process.
Richard Kyaw
Over the five days I learned a tremendous amount about CMMC. The course was organized in a way that made the material manageable to understand and apply.
Preetesh Patel

Your review could be next.

Pick a live class, or learn at your own pace with Guided CCP. Questions? Our training team answers fast.

Find your CCP class Ask the training team

CCA Training

Ready for the Next Step After CCP?

CCA training prepares you to run official CMMC Level 2 assessments. Not sure you're ready? Our team will help you check.

See CCA dates and enroll (opens in a new tab) Ask if you're ready

Helpful resources