How to Master One of the Hardest Parts of the ISACA CCA Exam: CMMC Ecosystem and Code of Professional Conduct

Many ISACA CCA candidates expect the ecosystem and professional conduct questions to be easy points. Then they meet a scenario where an OSC’s IT manager offers to “just show you the answer,” or where it’s unclear whether the Cyber AB, ISACA, the C3PAO, or the DoW makes a decision. These questions are tricky because the answer depends on who has authority and what an objective assessor can do.

Part of the challenge is that the ecosystem itself has changed. Roles shifted in 2025 and 2026, and earlier study materials may be out of date. In this guide, we’ll break down the roles, the rules, the traps, and a study plan that ties it all together.

Where Does This Topic Fit in the CCA Blueprint?

The CCA Test Blueprint v3.3 doesn’t list the ecosystem and professional conduct as a separate domain. Those topics are core to the CCP exam, which every CCA candidate has already passed. On the CCA exam, they show up inside the four blueprint domains, especially:

  • Domain 3, CMMC Assessment Process (25%): Who does what during planning, the assessment itself, reporting, and close-out, and how assessors must behave throughout.
  • Domain 4, Assessing CMMC Level 2 Practices (40%): Objectivity when judging evidence and how to handle what you see and hear during interviews and tests.
  • Domain 2, Assessment Scoping (20%): The roles of External Service Providers (ESPs) and cloud service providers.

That means the topic can touch a large share of the exam even without its own percentage.

Who Are the Key Players in the CMMC Ecosystem?

Know each role and, more importantly, what each one decides.

  • Department of War (DoW) CIO: Owns the CMMC program and its policy, published in 32 CFR Part 170.
  • The Cyber AB: The accreditation body. It accredits C3PAOs and the CAICO and coordinates Tier 3 background investigations for assessors.
  • CAICO (ISACA since December 2025): Certifies CCPs, CCAs, and instructors, manages exams, and oversees training providers.
  • C3PAO: An accredited organization that conducts Level 2 certification assessments and issues the resulting certificates.
  • Lead CCA and CCAs: The assessment team. The lead directs the assessment and makes final determinations on behalf of the C3PAO.
  • CCP: Can support assessment teams under CCA supervision, and often works for OSCs on readiness.
  • DIBCAC: The Defense Contract Management Agency team that conducts Level 3 assessments and evaluates C3PAO performance.
  • OSC: The Organization Seeking Certification, which defines its scope and provides the evidence.

What Do the CMMC Levels Require?

You’ll need these numbers without hesitation:

  • Level 1: Protects Federal Contract Information (FCI) with the 15 requirements from FAR 52.204-21. Annual self-assessment.
  • Level 2: Protects CUI with the 110 requirements of NIST SP 800-171 Rev. 2, assessed through 320 assessment objectives. Requires a self-assessment or C3PAO certification assessment every three years, plus an annual affirmation.
  • Level 3: Adds 24 requirements from NIST SP 800-172. Assessed by DIBCAC and requires a Level 2 certification first.

For Level 2 scoring, each requirement carries 1, 3, or 5 points. An OSC needs at least 88 of 110 points (80%) for Conditional status, and any POA&M items must be closed within 180 days. Only certain lower-value requirements can go on a POA&M, and the SSP requirement can never be deferred.

What Does Professional Conduct Mean for an Assessor?

The Cyber AB’s Code of Professional Conduct shaped how assessors were trained, and certified professionals now follow ISACA’s Code of Professional Ethics. The principles tested are consistent across both:

  • Objectivity and independence: Findings rest on evidence, not relationships or pressure. You can’t assess an organization you helped prepare for the assessment.
  • Confidentiality: OSC information, including CUI you see during the assessment, is protected and used only for the assessment.
  • Integrity of information: You report what the evidence shows, and you don’t alter, overstate, or “soften” findings.
  • Proper use of methods: You follow the CAP and the Assessment Guide instead of inventing your own standard.
  • Professional competence: You work within your certification and keep it current through CPE.

What Are the Most Common Traps?

  • Mixing up the Cyber AB and the CAICO. Questions about exams, certification, or CPE point to the CAICO. Questions about accrediting C3PAOs point to the Cyber AB.
  • Letting the assessor fix things. Assessors don’t give remediation advice during an assessment. Recommending a specific product or configuration crosses into consulting.
  • Accepting evidence because someone senior vouches for it. An executive’s statement is interview evidence, not proof on its own. It still needs corroboration through examination or testing.
  • Forgetting the chain of authority. Final determinations belong to the lead assessor on behalf of the C3PAO, not to the OSC or a team member acting alone.
  • Using outdated facts. Level 1 now has 15 requirements, and ISACA, not the Cyber AB, is the CAICO.

How Would You Reason Through a Sample Scenario?

Scenario 1

Consider a question where a CCA on a Level 2 assessment learns on day two that, eight months ago, her former employer, a consulting firm, wrote the OSC’s System Security Plan, and she reviewed part of it. The OSC says it doesn’t mind. What should she do?

Start by naming the principle: independence. Her prior involvement with the evidence she’s now judging creates a conflict of interest, and the OSC’s consent doesn’t cure it. Eliminate answers that let her continue but “avoid the SSP,” since the SSP underpins every practice.

The best answer is to disclose the conflict right away to the lead assessor and C3PAO so she can be removed from the assessment.

Scenario 2

Now consider a second question. During an interview, a system administrator says multifactor authentication is enforced for all remote access, and then admits the VPN exception list includes three engineers. The administrator asks you to leave that out because a fix is coming next week.

The objective answer is to record what you observed and score the practice against its objectives based on the evidence at that point. Future plans don’t change a current finding, although they may be relevant to a POA&M if the rules allow it.

How Does This Topic Connect to the Rest of the Exam?

  • Scoping: Knowing that ESPs and cloud service providers carry defined responsibilities helps you judge customer responsibility matrices and shared evidence.
  • CAP: Each phase has a responsible party, so role questions and process questions often overlap.
  • Practice assessment: Objectivity rules explain why you corroborate interview evidence with examine or test methods.

How Should You Study This Topic?

  1. Build a one-page role chart that shows who accredits, who certifies, who assesses, and who decides.
  2. Review the ecosystem and roles sections of 32 CFR Part 170 and the ethics expectations covered in your CCA training.
  3. Write out the Level 1, 2, and 3 numbers and the POA&M rules from memory until they stick.
  4. In Pocket Prep, use Build Your Own Quiz to target the CMMC Assessment Process subject, then revisit misses with Missed Questions quizzes a few days later.
  5. Finish with mixed Timed Quiz sessions, so you recognize conduct issues even when a question looks like a scoping or evidence question.

Start Preparing for the ISACA CCA Exam With Pocket Prep

Pocket Prep’s ISACA CCA practice questions include 500 exam-style questions with detailed explanations that walk through the roles, rules, and reasoning behind each answer. Take a Weakest Subject quiz to find your gaps, and use the Question of the Day to keep the material fresh. With a clear picture of the ecosystem and steady practice, you’ll be ready to think like an assessor on exam day.