Certified Authorization Professional (CAP)

Course Details

• DOMAIN 1: INFORMATION SECURITY RISK MANAGEMENT PROGRAM
• Risk management frameworks, cyber security framework, Control Objectives for Information and Related Technology (COBIT), International Organization for Standardization (ISO) 27001,
• International Organization for Standardization (ISO) 31000)
• System Development Life Cycle (SDLC)
• Information system boundary requirements
• Security controls and practices
• Roles and responsibilities in the authorization/approval process
• Understand risk management program processes
• Select program management controls,Privacy requirements
• Determine third-party hosted information systems, Understand regulatory and legal requirements
• Familiarize with governmental, organizational and international regulatory security and privacy requirements, Federal Risk and Authorization Management Program (FedRAMP),
• General Data Protection Regulation (GDPR), Health Insurance Portability and Accountability Act (HIPAA))
• Familiarize with other applicable security-related mandates
• DOMAIN 2: SCOPE OF THE INFORMATION SYSTEM
• Define the information system
• Determine the scope of the information system
• Describe the architecture (e.g., data flow, internal and external interconnections)
• Describe information system purpose and functionality
• Determine categorization of the information system
• Identify the information types processed, stored or transmitted by the information system
• Determine the impact level on confidentiality, integrity, and availability for each information type (e.g., Federal Information Processing Standards (FIPS) 199,
• International Organization for Standardization/ International Electrotechnical Commission (ISO/IEC) 27002,
• data protection impact assessment)
• Determine information system categorization and document results
• DOMAINE 3: SECTION AND APPROVAL OF SECUIRTY AND PRIVATE CONTROLS
• Identify and document baseline and inherited controls 3.2 Select and tailor controls to the system
• Determine applicability of recommended baseline and inherited controls
• Determine appropriate use of control enhancements (e.g., security practices, overlays, countermeasures)
• Document control applicability
• Develop continuous control monitoring strategy (e.g., implementation, timeline, effectiveness)
• Review and approve security plan/Information Security Management System (ISMS)
• DOMAIN 4: IMPLEMENTATION OF SECURITY AND PRIVACY CONTROLS
• Implement selected controls
• Determine mandatory configuration settings and verify implementation in accordance with current industry standards (e.g. propriate organization entities (e.g., physical security,
• personnel security, privacy)
• DOMAIN 5: ASSESSMENT/AUDIT OF SECURITY AND PRIVACY CONTROLS
• Prepare for assessment/audit
• Determine assessor/auditor requirements
• Establish objectives and scope, Determine methods and level of effort
• Determine necessary resources and logistics
• Collect and review artifacts (e.g., previous assessments/audits, system documentation, policies)
• Finalize the assessment/audit plan
• Conduct assessment/audit, Collect and document assessment/audit evidence
• Assess/audit implementation and validate compliance using approved assessment methods (e.g., interview, test and examine)
• Prepare the initial assessment/audit report , Analyze assessment/audit results and identify vulnerabilities, Propose remediation actions
• Review initial assessment/audit report and perform remediation actions, Determine risk responses, Apply remediations, Reassess and validate the remediated controls
• Develop final assessment/audit report
• Develop remediation plan, Analyze identified residual vulnerabilities or deficiencies, Prioritize responses based on risk level Identify resources and determine the appropriate timeframe/ schedule
• DOMAIN 6: AUTHORIZATION/APPROVAL OF INFORMATION SYSTEM
• Compile security and privacy authorization/approval documents
• Compile required security and privacy documentation to support authorization/approval decision by the designated official
• Determine information system risk, Evaluate information system risk
• Determine risk treatment options (i.e., accept, avoid, transfer, mitigate, share)
• Determine residual risk
• Authorize/approve information system
• Determine terms of authorization/approval
• DOMAIN 7: CONTINUOUS MONITORING
• Determine impact of changes to information system and environment
• Identify potential threat and impact to operation of information system and environment
• Analyze risk due to proposed changes accounting for organizational risk tolerance
• » Approve and document proposed changes (e.g., Change Control Board (CCB), technical review board)
• Implement proposed changes
• Validate changes have been correctly implemented
• Ensure change management tasks are performed
• .
• Perform ongoing assessments/audits based on organizational requirements
• Monitor network, physical and personnel activities (e.g., unauthorized assets, personnel and related activities)
• Ensure vulnerability scanning activities are performed
• Review automated logs and alerts for anomalies (e.g., security orchestration, automation and response)
• Review supply chain risk analysis monitoring activities (e.g., cyber threat reports, agency reports, news reports)
• Actively participate in response planning and communication of a cyber event
• Ensure response activities are coordinated with internal and external stakeholders
• Update documentation, strategies and tactics incorporating lessons learned
• Revise monitoring strategies based on changes to industry developments introduced through legal, regulatory, supplier, security and privacy updates
• Keep designated officials updated about the risk posture for continuous authorization/approval
• Determine ongoing information system risk
• Update risk register, risk treatment and remediation plan
• .
• Decommission information system
• Determine information system decommissioning requirements
• Communicate decommissioning of information system
• Remove information system from operations
• What you'll learn
• Understanding the purpose of information systems security authorization
• Defining systems authorization
• Describing and decide when systems authorization is employed
• Defining roles and responsibilities
• Understanding the legal and regulatory requirements for A&A
• Initiating the authorization process
• Establishing authorization boundaries
• Determining security categorization
• Performing initial risk assessment
• Selecting and refining security control
• Documenting security control
• Performing certification phase
• .
• Assessing security control
• Documenting results
• Conducting final risk assessment
• Generating and presenting an authorization report
• Performing continuous monitoring
• Monitoring security controls
• Monitoring and assessing changes that affect the information system
• Performing security impact assessment as needed
• Documenting and monitoring results of impact assessments
• Maintaining system’s documentation (e.g., POA&M, SSP, interconnection agreements)