Certified Authorization Professional (CAP) Bootcamp | Course Outline | ATG Learning

Course Outline

Certified Authorization Professional (CAP) Bootcamp

CISP-1003 | Day | 5 Days

You're constantly on the lookout for system risks and vulnerabilities. Take your commitment to security assessment and authorization to a new level with the CAP certification. This leading information security certification proves you're an expert aligning information systems with the Risk Management Framework (RMF). The CAP certification covers the RMF at an extensive level. And it's the only certification under the DoD8570 Mandate that aligns to each of the RMF steps.

The CAP shows you have the knowledge, skills and abilities to authorize and maintain information systems within the RMF. Specifically, it validates that you know how to formalize processes to assess risk and establish security documentation throughout the entire lifecycle of a system.

Upcoming Dates:

  • Dec 02, 2019 - Dec 06, 2019

Who should take this course

The CAP is ideal for IT, information security and information assurance practitioners and contractors who use the RMF in:

Course Objectives

This official (ISC)2 training is based on the seven domains found on the Common Body of Knowledge (CBK) for CAP, ensuring students successfully prepare for the CAP certification exam while also enhancing their overall competencies in authorizing and maintaining information systems.

Course Outline

Domain 1: Risk Management Framework (RMF)

Security authorization includes a tiered risk management approach to evaluate both strategic and tactical risk across the enterprise. The authorization process incorporates the application of a Risk Management Framework (RMF), a review of the organizational structure, and the business process/mission as the foundation for the implementation and assessment of specified security controls. This authorization management process identifies vulnerabilities and security controls and determines residual risks. The residual risks are evaluated and deemed either acceptable or unacceptable. More controls must be implemented to reduce unacceptable risk. The system may be deployed only when the residual risks are acceptable to the enterprise and a satisfactory security plan is complete.

CAP Training Objectives

Domain 2: Categorization of Information Systems

Categorization of the information system is based on an impact analysis. It is performed to determine the types of information included within the security authorization boundary, the security requirements for the information types, and the potential impact on the organization resulting from a security compromise. The result of the categorization is used as the basis for developing the security plan, selecting security controls, and determining the risk inherent in operating the system.

CAP Training Objectives

Domain 3: Selection of Security Controls

The security control baseline is established by determining specific controls required to protect the system based on the security categorization of the system. The baseline is tailored and supplemented in accordance with an organizational assessment of risk and local parameters. The security control baseline, as well as the plan for monitoring it, is documented in the security plan (SP).

CAP Training Objectives

Domain 4: Security Control Implementation

The security controls specified in the security plan are implemented by taking into account the minimum organizational assurance requirements. The security plan describes how the controls are employed within the information system and its operational environment. The security assessment plan documents the methods for testing these controls and the expected results throughout the systems life-cycle.

CAP Training Objectives

Domain 5: Security Control Assessment

The security control assessment follows the approved plan, including defined procedures, to determine the effectiveness of the controls in meeting security requirements of the information system. The results are documented in the Security Assessment Report. CAP Training Objectives

Domain 6: Information Systems Authorization

The residual risks identified during the security control assessment are evaluated and the decision is made to authorize the system to operate, deny its operation, or remediate the deficiencies. Associateddocumentation is prepared and/or updated depending on the authorization decision.

CAP Training Objectives

Domain 7: Monitoring of Security Controls

After an Authorization to Operate (ATO) is granted, ongoing continuous monitoring is performed on all identified security controls as well as the political, legal, and physical environment in which the system operates. Changes to the system or its operational environment are documented and analyzed. The security state of the system is reported to designated responsible officials. Significant changes will cause the system to re-enter the security authorization process. Otherwise, the system will continue to be monitored on an ongoing basis in accordance with the organization's monitoring strategy.

CAP Training Objectives