SecurityOctober 15, 202610 min read

CMMC CCA Training: Required Course vs Self-Study (2026)

You cannot self-study your way past the CMMC CCA training rule. Here is what the required course costs, and where self-study still decides the result.

  • Yes, ATP courseCourse required?
  • From $2,995Official course
  • Course requiredSelf-study
  • 80-120 hPrep time
  • $575 / $760Exam fee
CMMC CCA training vs self-study - price line of every course option

Table of Contents

The CCA is now run by ISACA, with new feesISACA was named the CMMC Assessor and Instructor Certification Organization (CAICO) in December 2025 and completed the handover from The Cyber AB by 1 April 2026. It now brands the credential CMMC Certified Assessor, and the exam costs US$575 for ISACA members or US$760 for non-members, so guides quoting the old Cyber AB fees are out of date.
SHORT ANSWER

Everyone who wants the CCA must pay for training: ISACA will not register you without a CAICO-approved course from an Approved Training Provider, and you need an active CCP first. Shop on price, dates and whether the instructors run real Level 2 assessments; the published prices we found run $2,995 to $3,499. Then self-study the free DoD guides and NIST SP 800-171A, which matter more than boot-camp extras. If you only need assessor knowledge, skip the course entirely.

The CMMC Certified Assessor (CCA) is the credential required to perform formal CMMC Level 2 certification assessments of defense contractors, usually on a C3PAO assessment team. ISACA now runs the exam: 150 multiple-choice questions in four hours, at PSI test centres or online, scored 200-800 with 450 to pass, for US$575 (members) or US$760.

This is one of the few exams where training is not optional. You must complete a CAICO-approved CCA course from an Approved Training Provider (ATP) before you can register, so the real choice is which provider, not whether to pay. The courses we found run four or five days and list $2,995 to $3,499, and several ATPs do not publish a price at all. ISACA's own CCA review course, question database and manual are announced but not yet on sale.

Is a course required for the CMMC CCA?

ISACA's 2026 candidate guide makes training step one: complete the mandatory CAICO-approved CCA course from an Approved Training Provider (listed on the CyberAB Marketplace) or ISACA, and hold an active CCP, before registering for the exam. To certify you also need 3+ years of cybersecurity and 1+ year of assessment or audit experience, a DoD 8140.3 work role 612 certification at intermediate or advanced level, a DoW Tier 3 determination and a US$50 application fee.

Cheapest way to meet the rule:The lowest published ATP price we found is New Horizons' five-day virtual CCA course at $2,995. Pay $575 rather than $760 for the exam by joining ISACA (US$145 plus chapter dues), and study the free DoD guides, 32 CFR Part 170 and NIST SP 800-171A alongside the course.

Three ways to prepare

Costs below are training only. The exam fee ($575 / $760) is the same whichever route you take.

OFFICIALStandard ATP CCA course (mandatory)
From $2,9954-5 days + 4-8 weeks review

A CAICO-approved CCA course, four or five days of live instruction, from a provider listed as an ATP on the CyberAB Marketplace. Expect the CMMC source documents, assessor roles and ethics, the assessment flow from planning to final report, scoping and asset categories, and practice-by-practice assessment of all 14 Level 2 families. Completing it is what lets you register for the exam.

Best for:Everyone sitting the CCA: no approved course, no exam. Choose on price, dates and whether instructors run real assessments.

Watch out:Confirm the provider is on the CyberAB Marketplace ATP list and that the class is the CCA course, not the CCP, before you pay.

GUIDED COURSEATP boot camp with exam and coaching extras
$3,499+4-5 days + 4-6 weeks review

Some ATPs wrap the mandatory course in boot-camp extras. Infosec's five-day CCA boot camp lists $3,499 and says it includes exam payment, exam insurance and unlimited practice exams. Training Camp's four-day version, delivered with ecfirst, adds a mock assessment and 180 days of coaching but excludes the ISACA exam fee and does not display its price.

Best for:Candidates whose employer or C3PAO wants the exam fee and a retake safety net handled in one purchase.

Watch out:Inclusions conflict: Infosec lists exam payment, Training Camp says ISACA rules bar bundling the exam. Get what is included in writing.

SELF-STUDYSelf-study on top of the required course
$0 (free documents)4-8 weeks after the course

Self-study cannot replace the course, but it decides whether you pass. The DoD's Level 2 Assessment Guide and Scoping Guide, 32 CFR Part 170, and NIST SP 800-171 Rev. 2 with SP 800-171A are free, and they are what assessors and the exam work from. ISACA lists its own CCA review course, question database and review manual as coming soon.

Best for:Every CCA candidate after the course, especially those without hands-on C3PAO assessment experience.

Watch out:It does not satisfy the training requirement, and ISACA's own CCA prep products had no release date or price in October 2026.

Every option on one price line

8 options for the CMMC CCA, placed by list price. The numbered pins match the table.

#OptionTypeList priceFormat and what you get
1Certified CMMC Assessor (CCA)New HorizonsOfficial$2,9955-day virtual instructor-led, or private group. Listed ATP; scoping, the assessment workflow and all 14 Level 2 practice families; CCP required to enrol
2CMMC Certified Assessor (CCA) Boot CampInfosec InstituteOfficial$3,4995-day live online or onsite; next listed 2-6 Nov 2026. Listed ATP; page lists exam payment, exam insurance and unlimited practice exam attempts
3CMMC Certified Assessor Boot CampTraining Camp (with ecfirst)OfficialNot shown on page4-day boot camp, online or in person. ecfirst ATP courseware, mock assessment, 180 days of coaching; the ISACA exam fee is not included
4CCA Online Review Course (announced)ISACAOfficialComing soon, not pricedOn-demand online course. Announced with a CCA questions database and review manual; no release date in October 2026
5CMMC Level 2 Assessment Guide and Scoping GuideDoD CIOFreeFreePDF downloads. The assessment objectives, methods and scoping rules a CCA applies on every Level 2 assessment
632 CFR Part 170 (CMMC Program rule)eCFRFreeFreeOnline regulation text. The rule that defines CMMC roles, CCA requirements and assessment procedures
7NIST SP 800-171 Rev. 2 and SP 800-171ANISTFreeFreePDF downloads. The 110 security requirements and the assessment objectives that Level 2 assessments check
8ExamCert CMMC CCA appExamCertExamCert$5.99Practice-question app for iOS and Android. 600+ exam-style questions with an explanation for every option, worked by domain

Whichever route you pick, test it

A course or a book only proves itself under exam conditions. The CMMC CCA app has 600+ exam-style CMMC CCA questions with an explanation for every option. Do a mixed set before you pay for anything else.

App StoreGoogle PlayFree CMMC CCA practice test

What a course gives you, and the free substitute

The honest question is not "is the course good?" but "which part of it can I not get for free?" For the CMMC CCA:

A paid course gives youFree or cheap substituteGap left
Proof of completing a CAICO-approved CCA courseNone. ISACA requires the course before you can register for the examLarge gap
Assessor-led practice examining evidence, interviewing and testingExamples in the DoD Level 2 Assessment Guide, plus shadowing a C3PAO team or running mock assessments at workPartial
Scoping drills on CUI, security protection and risk-managed assetsThe free DoD Level 2 Scoping Guide applied to your own or a client's network and data-flow diagramsPartial
Source documents gathered and explainedFree: 32 CFR Part 170, NIST SP 800-171 Rev. 2 and 800-171A, and the DoD Assessment and Scoping GuidesSmall gap
Practice questions and a mock examYour course question sets, ISACA's CCA questions database once it ships, and independent question banksPartial

Pay or self-study? 3 questions

Answer in order. The first yes decides it.

Q1Do you intend to sit the CCA exam and perform CMMC Level 2 assessments?
Then an approved CCA course is mandatory. Cheapest listed: $2,995 (New Horizons). Infosec's $3,499 boot camp lists exam payment. Check ATP status first.
NO ↓
Q2Are you a CCP who might move into assessor work in a year or two?
Wait on the CCA course until a C3PAO role is in sight, and read the free DoD Assessment Guide now so the course becomes review, not first exposure.
NO ↓
Q3Do you only need assessor-level knowledge for an OSC, RPO or internal readiness role?
Skip the CCA course. The DoD guides, 32 CFR Part 170 and NIST SP 800-171A are free and are what assessors work from; consider the CCP for a credential.
NO ↓
ALL NOWithout the exam you need no course: study the free DoD guides, 32 CFR Part 170 and NIST SP 800-171A, then test yourself with practice questions.

A complete CMMC CCA self-study kit

Everything a self-studier needs, at list price, totalled.

CAICO-approved CCA course from an ATPMandatory before exam registration; pick a provider from the CyberAB Marketplace ATP list.
From $2,995
ISACA CCP and CCA Exam Candidate Guide (2026)Exam format, domain weights, fees, retake rules and the certification steps in one document.
Free
CMMC Level 2 Assessment Guide (DoD CIO)Objectives, methods and examples for every Level 2 requirement; assessing practices is 40% of the exam.
Free
CMMC Level 2 Scoping Guide (DoD CIO)Asset categories and scoping rules; Level 2 assessment scoping is 20% of the exam.
Free
32 CFR Part 170 (eCFR)The program rule itself: roles, assessment procedures and what a CCA may and may not do.
Free
NIST SP 800-171 Rev. 2 and SP 800-171AThe 110 requirements and their assessment objectives, which Level 2 assessments are scored against.
Free
ExamCert CMMC CCA app (iOS and Android)600+ exam-style questions with an explanation for every option, worked by domain
$5.99
Self-study kit total: about 100% of the official route's ~$2,995$3,000.99

Finish the kit with exam-style practice

Work CMMC CCA questions by domain, see which areas a course would actually have helped with, and spend money only there.

App StoreGoogle PlayFree CMMC CCA practice test

FAQ

Can I self-study for the CCA instead of taking a course?

No. ISACA's 2026 candidate guide lists completing mandatory training from an approved training provider or ISACA as step one, and its CCA page says candidates must complete the CAICO-approved CCA course and hold an active CCP before registering. Self-study still decides whether you pass, but it cannot replace the course, and the CCP before it has its own mandatory training too.

How much does CCA training cost in total?

At list prices checked in October 2026, the approved CCA courses we found run from $2,995 (New Horizons, five days) to $3,499 (Infosec, five days); Training Camp does not display its price. Add the exam at US$575 for ISACA members or US$760 for non-members and a US$50 application fee after passing, on top of what you already spent on the CCP.

Who runs the CCA exam now?

ISACA. It was named the CMMC Assessor and Instructor Certification Organization in December 2025 and completed the handover from The Cyber AB by 1 April 2026. The Cyber AB remains the accreditation body and runs the marketplace listing Approved Training Providers. The exam is 150 questions in four hours at PSI centres or online, and 450 on a 200-800 scale passes.

Do I need my Tier 3 background check before CCA training?

No. ISACA says CCA candidates do not need to complete Tier 3 before taking the CCA training and exam. A Tier 3 determination from the Department of War is required to become certified, along with the experience application, the US$50 fee and a DoD 8140.3 work role 612 certification, so start that process early.

Does ISACA sell its own CCA prep material?

Not yet. ISACA's CCA page lists a CCA Online Review Course, a Questions, Answers & Explanations database and a CCA Review Manual in print and digital form, all marked coming soon in October 2026, with no prices. Until they ship, the free DoD and NIST documents plus your ATP course materials are the core study set.

Sources

Figures on this page come from ISACA and the other primary sources below:

Checked October 15, 2026. Fees, outlines and eligibility rules change — confirm with ISACA before you book.