Call
(301) 220 2802
CMMC Certified Assessor (CCA) Training & Certification Near Washington, DC
TrainACE delivers instructor-led CMMC Certified Assessor (CCA) training in Greenbelt, MD, and live online. CCA is the advanced, senior-level individual credential in the CMMC ecosystem - the certification required to serve as an assessor on official CMMC Level 2 certification assessments performed on behalf of a Certified Third-Party Assessment Organization (C3PAO). This course is built for experienced cybersecurity, audit, and compliance professionals who already hold their CMMC Certified Professional (CCP) credential and are ready to advance into formal assessment work.
This is an advanced-level certification. It is not a starting point in the CMMC ecosystem - candidates must already hold an active CCP certification and meet defined experience and background-investigation requirements before they are eligible to sit for the CCA exam. If you have not yet earned CCP, start with our CMMC Certified Professional (CCP) course instead.
Quick decision snapshot
- Best for: Experienced cybersecurity, audit, and compliance professionals who already hold CCP and want to perform formal CMMC Level 2 assessments.
- Why it matters: CCA is the credential that authorizes an individual to conduct official CMMC Level 2 certification assessments as part of a C3PAO assessment team - a role CCP alone does not permit.
- What TrainACE includes: Instructor-led training covering the CCA domains, exam-aligned study materials, and our Price & Quality Guarantee.
Got Questions?
For more information about your specific needs, call us at (301) 220 2802 or complete the form below:
Why Choose TrainACE for CCA Training?
Professionals pursuing CCA are already deep into the CMMC ecosystem - they know the stakes of getting assessor training right. What they need from a provider is credible, current instruction and a class that treats the material with the seriousness a formal DoD assessment role demands.
- DC-area focus on defense-sector training: TrainACE is based in the Washington, DC metro area, home to a dense concentration of defense contractors, C3PAOs, and DIB organizations navigating CMMC compliance.
- Instructors with real credentials: TrainACE instructors hold active certifications and meaningful classroom experience in their subject areas.
- Small class sizes: Enrollment is capped so every student gets direct instructor attention on a curriculum with real professional consequences.
- Lifetime Career Support: Free Skills Clinics, Study Groups, and Career Path Recommendations after you graduate.
What that means for you as a buyer
- Serious material, serious instruction: Assessor-level training requires depth, not a surface-level overview.
- Local relevance: Training grounded in the DC-area defense contracting environment where most of this work will actually happen.
- Honest pathway guidance: If you are not yet eligible for CCA, TrainACE will tell you and point you to CCP or the right foundational step first.
The Caliber of Instructor You Can Expect
All TrainACE instructors hold active certifications in the subjects they teach and have a minimum of three years of classroom experience. For CCA - a class built around formal, high-stakes assessment methodology - that standard matters even more.
Our CCA instruction is led by cybersecurity professionals with hands-on experience in compliance assessment, audit methodology, and federal contracting environments, who bring practical, scenario-based teaching to a certification built around real-world assessment judgment.
What to expect from a TrainACE CCA instructor
- Direct experience with cybersecurity compliance frameworks and assessment methodology
- Familiarity with the defense contracting and DIB environment where CMMC assessments take place
- Ability to walk through realistic assessment scenarios, not just exam objectives
This is the same instructional standard applied across every TrainACE course - technically current, practically grounded, and focused on getting you certification-ready.
CCA Prerequisites
CCA has real, enforced eligibility requirements - this is not a self-declared prerequisite like many entry-level certifications. Before you can register for the CCA exam, you must already hold an active CCP certification and meet defined experience, credentialing, and background-investigation requirements set by CAICO/Cyber AB.
To be eligible for the CCA exam, you generally need
- An active Certified CMMC Professional (CCP) certification in good standing
- At least three years of cybersecurity experience
- At least one year of assessment or audit experience
- A baseline certification aligned to at least the Intermediate Proficiency Level of DoD Cyber Workforce Framework Work Role 612 (Security Control Assessor), per DoD Manual 8140.03
- A favorable Tier 3 background investigation determination (or an accepted equivalent, such as a National Agency Check or recognized DoD clearance)
- U.S. citizenship
You must also complete a CAICO-approved CCA training course through an Authorized Training Provider before sitting for the exam.
You are likely a strong fit if you
- Already hold CCP and have been working in cybersecurity compliance, audit, or assessment roles
- Are aiming to work on a C3PAO assessment team performing official CMMC Level 2 assessments
- Have a qualifying baseline certification aligned to DoD Work Role 612 and are ready to pursue the background investigation process
You may need a different first step if you
- Do not yet hold CCP - start with our CMMC Certified Professional (CCP) course instead
- Do not yet meet the experience or baseline-certification requirements above - our advisors can help you map a realistic timeline toward CCA eligibility
CCA Exam Details
- Number of questions: 150 multiple-choice items
- Time limit: 4 hours
- Scoring: Reported on a standardized scaled score from 200-800
- Passing score: 500 or greater
- Format: Multiple choice only, delivered at authorized PSI testing centers or as a remotely proctored exam
- Can you evaluate evidence like an assessor? The exam centers on realistic assessment scenarios rather than simple recall of the CMMC model.
- Can you apply NIST SP 800-171A assessment procedures? Candidates must show they understand how to validate whether controls are implemented and sustained, not just whether they exist on paper.
- Can you exercise assessor judgment? Expect scenario-based questions on scoping, evidence sufficiency, and interview technique.
- The CCA's role and authority within a C3PAO assessment team
- How CCA differs from CCP - what a CCA can determine that a CCP cannot
- Conflict-of-interest rules and professional conduct requirements
- Working alongside Lead CCAs and other assessment team members
- Defining assessment scope: people, systems, and processes
- Identifying in-scope assets that handle Controlled Unclassified Information (CUI)
- Common scoping pitfalls and how they affect assessment outcomes
- Working with an Organization Seeking Certification (OSC) to confirm scope before fieldwork begins
- Applying NIST SP 800-171A assessment procedures across the CMMC Level 2 security requirements
- Evaluating whether controls are implemented, and whether implementation can be sustained over time
- Common evidence gaps across major control families such as access control, incident response, and configuration management
- Distinguishing documented policy from demonstrated practice
- Structuring effective assessor interviews with OSC personnel
- Evaluating documentation, system configurations, and artifacts as evidence
- Recognizing insufficient or inconsistent evidence
- Maintaining objectivity and confidentiality throughout the assessment process
- Applying scoring methodology consistently across findings
- Documenting findings clearly enough to support a certification determination
- Quality assurance expectations for assessment accuracy and defensibility
- Communicating outcomes to an OSC that does not meet certification requirements
- Handling CUI and assessment materials securely, using only C3PAO-provided, DoD-assessed systems
- Reporting obligations for suspected breaches or security incidents involving assessment data
- Maintaining CCA certification: renewal cycle, continuing education, and background investigation upkeep
- The path from CCA to Lead CCA (LCCA)
-
Lead CMMC Certified Assessor (LCCA)
The senior assessor credential, required to lead a C3PAO assessment team and deliver final compliance determinations. Requires additional documented assessment, audit, and management experience beyond CCA. -
ISACA CISA - Certified Information Systems Auditor
A natural lateral credential for CCAs who want to broaden into general IT audit and governance work beyond the CMMC ecosystem specifically. -
ISC2 CISSP - Certified Information Systems Security Professional
A broad, senior-level security credential that complements CCA for professionals moving toward security leadership or advisory roles alongside their assessment work. -
Greenbelt & Live-Online
08/24/26 - 08/28/26
Mon-Fri (8:30am-5pm)
-
Greenbelt & Live-Online
09/21/26 - 09/25/26
Mon-Fri (8:30am-5pm)
-
Greenbelt & Live-Online
10/19/26 - 10/23/26
Mon-Fri (8:30am-5pm)
-
Greenbelt & Live-Online
11/16/26 - 11/20/26
Mon-Fri (8:30am-5pm)
-
Greenbelt & Live-Online
12/07/26 - 12/11/26
Mon-Fri (8:30am-5pm)
Unscored, field-test items may appear throughout the exam alongside scored items; candidates cannot identify which is which, and field-test items do not affect the final score.
What the exam is really testing
What You'll Learn in This CCA Class
The curriculum builds directly on the assessor domains CAICO defines for the CCA credential, with an emphasis on how a real CMMC Level 2 assessment is planned, conducted, evaluated, and reported.
Module 1: The CCA Role and the Assessment Team
Module 2: Assessment Scoping
Module 3: NIST SP 800-171A Assessment Procedures
Module 4: Evidence Collection and Interview Technique
Module 5: Scoring, Reporting, and Quality Assurance
Module 6: Ethics, Confidentiality, and Ongoing Compliance
Frequently Asked Questions
How long is the CCA training?
The classes run for 40 hours with weekday, weekend and evening options
Do I need to already hold CCP before taking this class?
Yes. CCA is not a starting point in the CMMC ecosystem. You must hold an active CCP certification, along with the experience and background-investigation requirements outlined above, before you are eligible to sit for the CCA exam. If you have not yet earned CCP, start there first.
Is this the right level for me?
CCA is built for professionals who already work in cybersecurity compliance, audit, or assessment and who already hold CCP. If you are new to CMMC entirely, CCP is the right starting point. If you already hold CCP and are actively building assessment or audit experience, CCA is a logical next move.
What is TrainACE's pass rate?
We do not publish a pass rate figure, and you should be skeptical of any training provider that does. CCA exams are administered independently through CAICO's testing infrastructure, so training providers cannot accurately track student outcomes at scale. What we can tell you is that our instruction is live and hands-on, our instructors bring real assessment and compliance experience to the classroom.
Does CCA satisfy DoD 8140/8570 requirements?
CCA is closely tied to DoD 8140/8570 Work Role 612 (Security Control Assessor) - candidates must already hold a baseline certification aligned to at least the Intermediate Proficiency Level of that work role just to qualify for the CCA exam.
Where Does CCA Take You Next?
CCA authorizes you to work as an assessor on official CMMC Level 2 assessments. From there, most professionals build assessment experience toward one of these next-stage tracks.
Common next moves after CCA
Not sure which direction makes sense for your background? Call us at (301) 220-2802. Our advisors will give you a direct recommendation based on where you are in the CMMC pathway.
Ready to Enroll?
Select a class date from the schedule below, or call us at (301) 220-2802 to speak with an advisor about eligibility and the right timing for your background. If you have not yet earned CCP, we will tell you that up front and help you map the right path first.
Got Questions?
For more information about your specific needs, call us at (301) 220 2802 or complete the form below:
Class Schedule
Get your CMMC Certified Assessor (CCA) Training & Certification Near Washington, DC training in our convenient IT training centers in Maryland or Virginia.