CCA Requirements 2026: Who Can Sit the Exam and What It Costs
Before you can book a seat you have to clear ISACA’s eligibility gates. Here is exactly what they check, in the order they check it.
Table of Contents
What the CCA credential is
The CMMC Certified Assessor (CCA) is awarded by ISACA, which took over from The Cyber AB as the CMMC Assessor and Instructor Certification Organization (CAICO) in a handover completed on 1 April 2026; The Cyber AB remains the CMMC accreditation body. It is not a course certificate you can buy your way into — ISACA decides whether you are allowed to sit the exam at all, and that decision is made before you ever see a question. Candidates who treat the application as a formality are the ones who lose a testing window to a paperwork problem.
The eligibility gates, in order
ISACA checks all four, and failing any one of them stops you. Its CCA page requires Gates 1, 3 and 4 before you can register for the exam; the experience in Gate 2 is verified when you apply for certification after passing. Work through them top to bottom before you pay a fee.
Gate 1
Hold an active CMMC Certified Professional (CCP) certification - passing the CCP exam alone is not enough
Gate 2
Three years of cybersecurity experience plus one year of audit or assessment experience
Gate 3
Hold at least one active baseline certification under DoD 8140.03 Work Role 612, Security Control Assessor, at Intermediate or Advanced proficiency - CISA and CISM both qualify
Gate 4
Complete the mandatory CAICO-approved CCA course from an Approved Training Provider before you register
ISACA allows four attempts in a rolling 12-month period. After a failed first attempt you wait 30 days, then 90 days after each of the second and third attempts, and every attempt costs the full registration fee.
What it costs
ISACA charges US$575 for members and US$760 for non-members to register for the CCA exam, and a US$50 application processing fee once you pass. Registration opens a six-month window to sit the exam, fees are nonrefundable, and each retake costs the full registration fee again, so budget for one. The mandatory CCA course is priced separately by each Approved Training Provider.
What the exam itself looks like
The CCA exam is 150 multiple-choice questions in four hours, each with four options and one best answer, delivered in English by PSI at a test centre or through online remote proctoring. Results are reported on a 200-800 scaled score and you need 450 or higher to pass. The four domains are assessing CMMC Level 2 practices (40%), the CMMC Assessment Process (25%), Level 2 assessment scoping (20%) and evaluating Organizations Seeking Certification (15%).
How long the process takes
Three clocks run at once and candidates usually notice only two. The first is the experience clock: the hours or years in the gates above have to be accrued, and in most programmes accrued recently, so time spent in the wrong role does not count no matter how long you spent there. The second is the approval clock: transcripts, licence verification and reference checks are done by people rather than scripts, and they run in weeks rather than days. The third is the eligibility window: once approved you have a fixed period to sit the exam, and letting it lapse means reapplying and paying again.
Plan backwards from the date you want the credential in hand, not forwards from the day you decide to start. The paperwork is the part that is outside your control, so it should go first.
Why applications get sent back
The failure modes are boring and they repeat. Hours logged in a role that does not match the definition in the handbook. A transcript sent by the candidate instead of by the school. A licence that is current but carries a restriction. Experience that is genuine but falls outside the lookback window. None of these are judgement calls you can argue your way past — they are checkboxes. Read the eligibility page as though it were a contract, because for the purposes of your application it is one.
Once you are approved, the work is question volume. Practise CCA questions free and find out where you actually stand before you book a date.
FAQ
Who is eligible to sit the CCA exam?
Hold an active CMMC Certified Professional (CCP) certification, have three years of cybersecurity experience plus one year of audit or assessment experience, hold at least one active certification under DoD 8140.03 Work Role 612, Security Control Assessor, at Intermediate or Advanced proficiency, and complete the mandatory CAICO-approved CCA course from an Approved Training Provider.
How much does the CCA exam cost?
ISACA charges US$575 for members and US$760 for non-members to register, plus a US$50 application processing fee after you pass. Each retake costs the full registration fee again.
How many questions are on the CCA exam?
150 multiple-choice questions in four hours, according to the 2026 ISACA candidate guide for the CCP and CCA exams.
How long does CCA approval take?
Verification is manual, so allow weeks rather than days between submitting an application and being cleared to schedule. Once you are approved a fixed eligibility window starts running, and letting it expire means paying to apply again.
Sources
Every figure on this page comes from the certifying body, not from a third-party summary:
- https://www.isaca.org/credentialing/cca
- https://www.isaca.org/-/media/files/isacadp/project/isaca/certification/exam-candidate-guides/2026/cca-ccp_exam_candidates_guide.pdf
Checked October 15, 2026. Fees and eligibility rules change; confirm against ISACA before you pay anything.