• Classroom
  • Online, Instructor-Led

The Risk Management Framework (RMF) is used by security professionals who are responsible for assessing risk and establishing documentation for their IT systems. The Certified Authorization Professional (CAP) certification covers the RMF in great detail and is the only security certification under the DoD8570 Mandate that aligns to each of the RMF steps. This official ISC2 course provides students with in-depth coverage on the skills and concepts in the 7 domains including RMF, Security Categorization, Security Controls implementation, assessment, monitoring, and authorization. This course is for IT Professionals interested in learning more about lifecycle cybersecurity risk management, as well as auditors, infosec/information assurance practitioners and program managers.

Learning Objectives

  • Distinguish the differences between the Risk Management Framework (RMF) steps and how the RMF process relates to the organizational structure.
  • Examine the relationship between the RMF and System Development Life Cycle (SDLC).
  • Assess legal, regulatory, and other security requirements.
  • Utilize the system through categorization, descriptions including security authorization boundaries and registration.
  • Create a documented plan for (inheritable) controls and security controls highlighting their effectiveness.
  • Develop security control monitoring strategy.
  • Develop a security assessment report (SAR) and provide a review interim SAR and initial remediation actions with a final SAR and optional addendum.
  • Develop plan of action and milestones (POAM) (e.g., resources, schedule, requirements).
  • Assemble security authorization package and obtain security authorization decision.
  • Determine risk and acceptability.
  • Determine security impact of changes to system and environment.
  • Perform ongoing security control assessments (e.g., continuous monitoring, internal and external assessments) and remediation actions (resulting from incidents, vulnerability scans, audits, vendor updates, etc.).
  • Perform periodic security status reporting, ongoing risk determination and acceptance.

Framework Connections

The materials within this course focus on the NICE Framework Task, Knowledge, and Skill statements identified within the indicated NICE Framework component(s):