CMMC CCA study guide
CMMC CCA · Work through your exam, one topic at a time.
The CMMC Certified Assessor (CCA) is a professional credential within the Cybersecurity Maturity Model Certification (CMMC) ecosystem, which is coordinated by The Cyber AB, the accreditation body that lists Assessors among the CMMC professions it recognizes. A CCA is the individual who evaluates whether a Defense Industrial Base (DIB) organization has actually implemented the practices it claims - work that depends less on memorization than on disciplined scoping, impartial evidence collection, and defensible judgment. The CMMC CCA study guide has 5 sections and about 1,567 words.
01CMMC Ecosystem, Roles, and Code of Professional Conduct
CMMC is a DoD program codified in 32 CFR Part 170. Policy and program management belong to OUSD(A&S) and the CMMC Program Management Office; contracting officers and requiring activities use an organization's CMMC status in award decisions.
353 words, about 2 min02CMMC Assessment Process (CAP) Planning and Scoping
Planning and scoping decide what will be assessed before a single artifact is requested. The CAP expects an assessment agreement, a defined and credentialed team, an assessment plan, a documentation request list, and a validated scope.
317 words, about 2 min03CMMC Level 2 Practice Assessment (NIST SP 800-171)
Level 2 is the 110 security requirements of NIST SP 800-171 across 14 families (AC, AT, AU, CM, IA, IR, MA, MP, PE, PS, RA, CA, SC, SI). Each requirement has assessment objectives in NIST SP 800-171A.
303 words, about 2 min04Evidence Collection, Interviewing, and Objective Validation
The CAP validates objectives with examine (review artifacts, observe), interview (talk to the performers), and test (execute or verify a mechanism). Each objective needs at least one validated method; if the team cannot validate it, the practice cannot be MET.
282 words, about 1 min05Assessment Reporting, Findings, and Post-Assessment Activities
The final assessment report states the scope, the practice-by-practice determinations, the objectives that failed, the evidence relied upon, and the overall result. Findings are written factually: practice ID, the objective not satisfied, the evidence observed, and the gap.
312 words, about 2 min