Official websites use .gov
A .gov website belongs to an official government organization in the United States.
Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.
CAP: Certified Authorization Professional
The Risk Management Framework (RMF) is used by security professionals who are responsible for assessing risk and establishing documentation for their IT systems. The Certified Authorization Professional (CAP) certification covers the RMF in great detail and is the only security certification under the DoD8570 Mandate that aligns to each of the RMF steps. This official ISC2 course provides students with in-depth coverage on the skills and concepts in the 7 domains including RMF, Security Categorization, Security Controls implementation, assessment, monitoring, and authorization. This course is for IT Professionals interested in learning more about lifecycle cybersecurity risk management, as well as auditors, infosec/information assurance practitioners and program managers.
Course Overview
- A minimum of 2 years full-time experience in one or more of the 7 domains covered in the CAP exam.
8890 McGaw Road
Suite 200
Columbia, MD 21045
625 W Adams Street
Chicago, IL 60661
5908 Headquarters Drive
Suite 400
Plano, TX 75024
201 N Franklin St
Floor 37
Tampa, FL 33602
40 E. Rio Salado Parkway
Suite 200
Tempe, AZ 85281
- Providers
- Courses
- Course and Provider Quantity
Learning Objectives
- Distinguish the differences between the Risk Management Framework (RMF) steps and how the RMF process relates to the organizational structure.
- Examine the relationship between the RMF and System Development Life Cycle (SDLC).
- Assess legal, regulatory, and other security requirements.
- Utilize the system through categorization, descriptions including security authorization boundaries and registration.
- Create a documented plan for (inheritable) controls and security controls highlighting their effectiveness.
- Develop security control monitoring strategy.
- Develop a security assessment report (SAR) and provide a review interim SAR and initial remediation actions with a final SAR and optional addendum.
- Develop plan of action and milestones (POAM) (e.g., resources, schedule, requirements).
- Assemble security authorization package and obtain security authorization decision.
- Determine risk and acceptability.
- Determine security impact of changes to system and environment.
- Perform ongoing security control assessments (e.g., continuous monitoring, internal and external assessments) and remediation actions (resulting from incidents, vulnerability scans, audits, vendor updates, etc.).
- Perform periodic security status reporting, ongoing risk determination and acceptance.
Framework Connections
The materials within this course focus on the NICE Framework Task, Knowledge, and Skill statements identified within the indicated NICE Framework component(s):
Competency Areas
Feedback
If you would like to provide feedback on this course, please e-mail the NICCS team at NICCS@mail.cisa.dhs.gov. Please keep in mind that NICCS does not own this course or accept payment for course entry. If you have questions related to the details of this course, such as cost, prerequisites, how to register, etc., please contact the course training provider directly. You can find course training provider contact information by following the link that says “Visit course page for more information...” on this page.