How to Become a CMMC Assessor: CCP and CCA Requirements
By Shaheer Malik · Updated Oct 28, 2026
To become a CMMC assessor you first become a CMMC Certified Professional (CCP), then a CMMC Certified Assessor (CCA). Both are certified by the CMMC Assessor and Instructor Certification Organization (CAICO), need a Tier 3 background investigation, and last three years. A CCA also needs at least three years of cybersecurity experience, one year of assessment or audit experience, and a qualifying foundational certification.[1]
The roles
| Role | What they can do |
|---|---|
| CMMC Certified Professional (CCP) | Join Level 2 certification assessments under a CCA, who makes all final determinations; eligible to become a CCA |
| CMMC Certified Assessor (CCA) | Conduct Level 2 certification assessments on a C3PAO assessment team |
| Lead CCA | Leads the assessment team; each team needs a Lead CCA and at least one other CCA |
| CMMC Instructor | Teaches CMMC training |
From 32 CFR 170.9 to 170.13.[1]
Requirements for a CCP
- Certification from the CAICO after the CCP training and testing; valid three years.[1]
- Comply with the Accreditation Body’s conflict of interest, conduct and ethics policies.[1]
- A Tier 3 background investigation (SF 86) with a favorable national security eligibility determination; it does not give you a clearance.[1]
Requirements for a CCA
- Be a CCP with at least 3 years of cybersecurity experience, at least 1 year of assessment or audit experience, and at least one foundational qualification aligned to the Intermediate level of the DoD Security Control Assessor (612) work role in DoD Manual 8140.03.[1]
- CAICO certification, valid three years; Tier 3 background investigation.[1]
- On assessments, use only IT and devices provided by the engaging C3PAO.[1]
Do you need a clearance or US citizenship?
The rule requires the Tier 3 investigation, which “will not result in a security clearance.” People not eligible for it must meet a DoD-determined equivalent.[1]
Working as an assessor
CCAs work through C3PAOs. See which firms are authorized in the C3PAO list.
FAQ
How do I become a CMMC assessor?
Become a CMMC Certified Professional through CAICO training and testing, pass a Tier 3 background investigation, gain 3 years of cybersecurity and 1 year of audit experience plus a qualifying certification, then certify as a CMMC Certified Assessor.
How long is a CMMC CCP or CCA certification valid?
Three years from the date of issuance.
Can a CCP lead an assessment?
No. A CCP takes part under a CCA, who makes all final determinations. Each assessment team needs a Lead CCA and at least one other CCA.
Sources
- 32 CFR part 170, CMMC Program (eCFR, current text) (checked Oct 28, 2026)
More on hiring help
- C3PAO vs RPO: Who Does What in CMMC
- How to Choose a CMMC Consultant
- CMMC for MSPs and ESPs: Rules for Service Providers
- How to Choose a C3PAO for Your CMMC Assessment
Get quotes from matching firms
Describe what you need once. It goes to up to 3 matching firms, never published or sold.
Request quotesIndependent directory. Not affiliated with, endorsed by, or acting on behalf of The Cyber AB, the DoD, or any listed firm. Credential status can change; confirm on the Cyber AB Marketplace.