CMMC is federal law — and it's already in the contracts. The clause went live November 10, 2025, and the whole defense supply chain now has to comply. The higher-stakes contractors can no longer just self-attest; they must prove it to a third-party assessor by November 10, 2026 — and there aren't enough qualified people for the work. Earn your CCP, your CCA, or both, self-paced and taught by a working assessor, and step in before the rush.
No vendor hype. Every figure below comes from the Department of War rule in the Federal Register, the Code of Federal Regulations, or U.S. Department of Justice settlements. Tap any source to read it yourself.
The Government Accountability Office reports the Department of War relies on about 200,000 defense industrial base companies — and CMMC reaches across all of them, from Level 1 (companies handling FCI) to Level 2 (companies handling CUI).
Source: U.S. GAO (GAO-26-107955) ↗Level 2 means implementing and documenting all 110 NIST SP 800-171 controls — then proving each one to an assessor. Nearly every affected contractor needs people who know them cold, and there aren't nearly enough.
Source: 32 CFR §170.14 / NIST 800-171 ↗The Department of War projects a Level 2 certification assessment costs ~$105,000 for small and ~$118,000 for larger entities, every three years. That's the budget your clients are now planning around.
Source: DoW Regulatory Impact Analysis · via DefenseScoop ↗The Department of War's regulatory analysis puts the annualized cost of CMMC compliance to industry at roughly $4 billion. That spend flows to the people who know how to do the work.
Source: DoW Regulatory Impact Analysis · via DefenseScoop ↗What Raytheon and Nightwing paid to resolve False Claims Act allegations of falsely certifying cybersecurity compliance. Getting this wrong is now a multimillion-dollar liability — which is why qualified help is in demand.
Source: U.S. Dept. of Justice ↗What MORSECORP paid in a DOJ settlement over cybersecurity-compliance failures on Army and Air Force contracts. Enforcement isn't theoretical — it's already happening.
Source: U.S. Dept. of Justice ↗CMMC requirements started appearing in Department of War solicitations and contracts on November 10, 2025 — Phase 1 of the rollout. The clause is real and active today: DFARS 252.204-7021 (NOV 2025) makes a CMMC status a condition of award. Contractors need help now, not next year.
Sources: DFARS 252.204-7021 · Acquisition.gov ↗ · 32 CFR Part 170 (eCFR) ↗ · U.S. DOJ ↗
Get qualified before the rushuntil Nov 10, 2026 — but the clause is already live today
We priced every Approved Training Partner that publishes CCP and CCA rates (June 2026). Here's the full CCP + CCA path across the market — next to what you'll pay today.
Training only. Market figures from a June 2026 scan of published ATP pricing (Redspin, Infosec, Edwards, CyberDI, Space Coast Cyber and others). ISACA exam & application fees are paid separately, the same as with any provider.
The CCP teaches you the model. The CCA teaches you how it's actually judged. Together, they make you the person clients trust to get them through — and the person C3PAOs trust when they walk in the door.
The CCA puts you on the other side of the table. You stop guessing whether an objective is "met" and start preparing clients against the same evidence and scoring an assessor will use. That insider lens is priceless when your whole job is getting a company assessment-ready — even if you never run an assessment yourself.
CCP gives you the framework fluency to advise and implement. CCA layers on assessment judgment, so your gap analyses, SSPs, and POA&Ms hold up under real scrutiny. You become the consultant who fixes problems before they become findings.
When the assessment team sees the person who prepared the client holds a CCA, it changes the conversation. You speak their language, your evidence is organized the way they expect, and the whole engagement runs smoother — which is exactly what your client is paying you for.
CCP is the required prerequisite for CCA — so doing them back-to-back while the material is fresh is the fastest, cheapest path to both. Finish the bundle and you hold the two credentials the DIB is hiring for, not just one.
Learn on your schedule, then show up live whenever you want a human in the loop.
40 hours of CCP and 40 hours of CCA — each a complete Approved Training Partner certificate course, with video instruction, slides, exercises, and exam prep for both exams.
Each course includes 3+ hours of group or one-on-one time with the instructor — so take both and that's 6+ hours. Bring your real questions and work through them live.
Recurring live group sessions run for months. Drop in to ask questions, review tough domains, and study alongside other professionals on the same path.
No week off work, no travel, no classroom. Study nights and weekends and keep producing — the flexible format is built around busy practitioners.
Enroll in the next 30 days and complete both courses on your timeline before December 31, 2026 — while self-paced is still on the table.
CCP and CCA together at the lowest combined price we offer — the complete path to the two credentials the DIB actually wants.
Chris is the CEO of Meerkat Cyber and one of roughly 42 people in the world authorized to perform certified CMMC assessments. A trained aeronautical and astronautical engineer who added a law degree to his undergraduate work, he holds the highest credentials the DoD CMMC program offers — CCA, CCP, and CCI. Across a three-decade career he's served as a Senate policy analyst and as CTO of a cybersecurity firm, and as a technical writer he has authored hundreds of patent applications, is a named inventor on numerous patents, has written for Nobel laureates and universities, and was recently engaged by Microsoft to write the CMMC implementation guide. He doesn't just teach the framework — he explains how it's interpreted, argued, and assessed.
A credential gets you in the door. The Cyber Tackle Box is how you actually do the work — and get paid for it. Take both courses and we give you a full year of our GRC platform for one client company (up to 50 employees), free. The day you finish, you're not job-hunting — you're delivering.
A CCP or CCA without a platform means running gap assessments, 50+ policies, evidence, and reports by hand. The Cyber Tackle Box does it for you: pre-built policy library, guided gap assessment, evidence collection, and audit-ready reports a C3PAO will accept.
Bring in one real client (up to 50 employees), put them in the platform, and bill the readiness work — gap analysis, SSP, POA&Ms, evidence. You finish certified and already earning, instead of starting from zero.
The same client seat covers NIST 800-171, CMMC, SOC 2, HIPAA, FedRAMP and more — "map once, comply many." One relationship, many ways to help them and grow the engagement.
The platform's embedded training walks every control — reinforcing the coursework and giving you a repeatable system to take any client from gap analysis to assessment-ready.
When the program moves fully to ISACA at year-end, the course changes — and self-paced is expected to go away with it.
Add CMMC readiness to your service line and keep clients in the DIB winning contracts.
Speak the assessor's language and stand behind your programs with credentialed authority.
Deliver gap analyses and SSPs that hold up — and win trust with the C3PAOs you work beside.
Own CMMC from the inside and prepare your organization to pass the first time.
Lionfish Cyber Security is an Accredited Training Partner for CMMC (CyberAB / ISACA-CAICO) and a state-certified technical school. We're accredited by the Office for Career and Technical Schools — so this training meets established standards of quality and relevance, and aligns with both industry needs and regulatory requirements.
We're a veteran-built company, and this isn't about being the cheapest for its own sake. Every defender we train is one more qualified person helping a Department of War contractor actually meet the NIST SP 800-171 / CMMC Level 2 standard — so the warfighter gets reliable, secure products from a supply chain that's hardened against our adversaries. We priced it to put more capable people into that fight, fast. That's why it's the best deal you'll find.
Your choice. One credential — CCP or CCA — is $1,999. But here's the move most people make: take both today and your CCP drops to half price ($999), so the complete CCP + CCA path is $2,998 instead of $3,998 — you save $1,000. Taking both also unlocks the headline bonus: a full year of the Cyber Tackle Box GRC for one client company (up to 50 employees) — a $3,500–$5,000 value, free — plus the control-by-control training inside it. It's the platform you use to run a real client engagement and start billing the day you finish. Each course is a full Approved Training Partner certificate course — 40 hours of CCP and 40 hours of CCA (80 hours total) — with 3+ hours of live instructor time each (6+ hours if you take both) and months of live office hours and study sessions.
Because we cite them. The 200,000+ affected companies, the 110 NIST 800-171 controls required for Level 2, the $105K–$118K assessment cost, and the $4B/year figure all come from the federal CMMC rule in the Federal Register and its Regulatory Impact Analysis. The November 10, 2026 phase-in is in the Code of Federal Regulations (32 CFR §170.3). The enforcement settlements come from U.S. Department of Justice press releases. Every stat on this page links to its source — read them yourself.
No. The CCA's biggest payoff for consultants and MSPs is knowing exactly how assessors judge each objective. That makes you dramatically better at getting clients assessment-ready, and it gives you instant credibility with the C3PAOs who come in to assess — even if you never sit on an assessment team.
Yes. Lionfish Cyber Security is an Accredited Training Partner for CMMC (CyberAB / ISACA-CAICO) and a state-certified technical school accredited by the Office for Career and Technical Schools. Our courses are recognized certificate programs — 40 hours of CCP and 40 hours of CCA — built to meet the standards the credentialing bodies and the regulation require.
Because the discount has a purpose. We're a veteran-built company, and every person we train is one more qualified defender helping a Department of War contractor genuinely meet the NIST SP 800-171 / CMMC Level 2 standard. A stronger, better-trained supply chain means the warfighter gets reliable, secure products. We priced this to get more capable people into that work quickly — during the 30-day enrollment window.
The core training is fully on-demand — start and finish on your own schedule. On top of that, you get live instructor time and recurring group office hours and study sessions for months, so you can get help from a real person whenever you want it.
When the program transitions to ISACA at the end of the year, the course is changing and self-paced learning is expected to be discontinued in favor of scheduled, instructor-led seat time. Enroll within 30 days and complete both courses before December 31, 2026 to learn this flexible way while it's still available.
This price covers the training. The ISACA exam and application fees are paid separately to the credentialing body — the same as with any Approved Training Provider. We'll point you to the current figures so there are no surprises.
One credential proves you know the standard. Both make you the person the assessor trusts — and the contractor can't replace. You're already investing $1,999 to get here; for half that, complete the path today. Finish before year-end, before ISACA changes the format.
Taking both? Enroll in your first credential now, then book a quick call and we'll apply the half-off second credential so the complete path is $2,998.
