We’ll guide you based on your experience and career goals.

Basic cybersecurity knowledge is recommended.

Yes — our training is structured around current CMMC guidelines.

CCA candidates do not need to have completed Tier 3 before they can take the CCA exam. If you pass the CCP exam and take CCA training, you can take the CCA exam—just as you could previously.

CyberAB will continue to run point on Tier 3 Investigations for CCPs and CCAs.

While new exam prices have increased compared to the old model and in line with similar industry certifications, we are happy to report that annual renewal costs have decreased to the extent that total cost of ownership over the three-year cycle is very similar and, in some cases, substantially lower. For example, three-year total costs for someone holding CCP and CCA were $3,175 with previous pricing. Those become $2,280 through ISACA and are reduced to $2,105 with ISACA membership.

The background check process starts after you've completed CCP training, passed the CCP exam and applied for the certification. During the application process, ISACA will validate your experience and then send your information to CyberAB so the background check can start.

Yes. For CCPs and CCAs, a minimum of 20 CPE must be earned each year, with a total of 120 CPE over a three-year cycle. At least 90 CPE must relate to the certification itself, and two of the 90 must relate to CMMC rules. The remaining 30 CPE can relate to the certification or to general professional development, such as leadership, soft skills and mentorship. Lead CCAs do not need to report any additional CPE to maintain that credential.

Yes, if the CPE activity fulfils both an ISACA certification and CCP you're able to apply those CPEs to both certifications.

Both options are available.

ISACA has been authorized as the CMMC Assessor & Instructor Certification Organization (CAICO) and is now managing the training, examination and professional certification for individuals within the CMMC ecosystem. The credentials ISACA administers for the US Department of War CMMC program are the CMMC Certified Assessor (CCA), Lead CMMC Certified Assessor (LCCA), CMMC Certified Professional (CCP) and CMMC Certified Instructor (CCI).

The Cybersecurity Maturity Model Certification (CMMC) is an assessment framework and assessor certification program intended to increase the trust in measures of compliance to a variety of standards published by NIST. The purpose of the CMMC is to verify that the information systems used by DoD contractors to process, transmit or store sensitive data are compliant with the mandatory information security requirements.

The CCP is a foundational certification within the CMMC ecosystem designed for professionals who want to support organizations with pre-assessments, join CMMC assessment teams under a CCA/C3PAO, or eventually become a CCA themselves. A CCP helps with gap analysis, evidence collection, validation, and audit preparation.

The CCA is a mid-to-advanced level certification that qualifies professionals to conduct Level 2 CMMC assessments for defense contractors, serve as part of a C3PAO team, and make final determinations on compliance. CCAs may choose to pursue a Lead CCA designation as a next step.

CMMC certifications require individuals in assessment roles to obtain a Tier 3 determination from the Department of War. Tier 3 involves a background investigation; however, it does not grant or authorize security clearance. The determination is used solely to establish national security eligibility to participate in CMMC assessment activities.

Yes. There are education and experience requirements needed for CCP eligibility. For CCA eligibility, candidates must fulfill a baseline certification requirement under DoD 8140.03's Work Role 612 (Security Control Assessor) at the Intermediate or Advanced proficiency levels. ISACA's CISA and CISM are two certifications that candidates can choose from among the prerequisites.

No, any organization in any country that is eligible and wants to do business with the US Department of War must be CMMC-compliant based on the staging and rules set by the Federal Acquisition Regulations.

Yes, these certifications are a great complement to other industry credentials and can greatly increase a cybersecurity professional's or team's technical depth, even if the organization is not aligned to the defense industrial base.