Certified CMMC Assessor
Also known as: CCA
A Certified CMMC Assessor (CCA) is an individual credentialed by the Cyber AB to lead CMMC Level 2 assessments under a C3PAO. CCAs are not required for Level 1, and the credential itself does not authorize anyone to issue a Level 1 certification.
Related terms
- CMMC Third-Party Assessment Organization
A CMMC Third-Party Assessment Organization (C3PAO) is an entity accredited by the Cyber AB to perform CMMC Level 2 assessments on behalf of DoD contractors. C3PAOs are not used at Level 1, Level 1 is exclusively self-assessed, and they are not used at Level 3, which is assessed by DIBCAC. The DoD suspension of CMMC Phase 2 on July 13, 2026 paused the rollout that would have required C3PAO assessments on covered contracts beginning November 10, 2026, and the memo cites severe shortages in third-party assessment capacity as one reason for the review.
- Cyber AB
The Cyber AB is the sole accreditation body for the CMMC ecosystem. It is responsible for authorizing and accrediting C3PAOs, Certified CMMC Assessors (CCAs), Certified CMMC Professionals (CCPs), and Registered Practitioners (RPs).
- Certified CMMC Professional
A Certified CMMC Professional (CCP) is the baseline credential issued by the Cyber AB for individuals participating in the CMMC ecosystem. CCPs may serve as assessment team members under a CCA, but the credential alone does not authorize them to lead assessments or issue certifications.