The Certified Authorization Professional (CAP) training is aimed at providing knowledge and skills to professionals for maintaining and authorizing information system. This certification is significant to those responsible for establishing information security requirements and documentation along with formalizing risk assessment processes of an information security system. A CAP certified individual ensures the right level of security for information assets which are exposed to potential risk and damage.
The CAP credential is meant for commercial markets, local and civilian government. Also, it is recognized by the U.S. Federal government including the DoD (Department of Defense) under Information Assurance and Management. This course is ideal for authorization officials, information security professionals, information owners and senior system managers
Who Should Attend
The CAP is ideal for IT, information security and information assurance practitioners and contractors who use the RMF in:
The U.S. federal government, such as the U.S. Department of State or the Department of Defense (DoD)
The military
Civilian roles, such as federal contractors
Local governments
Private sector organizations
Prerequisites
To qualify for the CAP certification, you must have:
A minimum of two years cumulative, paid, full-time work experience
In one or more of the seven domains of the CAP Common Body of Knowledge (CBK)
To maintain certification, you must:
Earn and post a minimum of 20 (ISC)2 CPE credits per year
Comply with (ISC)2's Code of Professional Ethics
*Course Cost listed does not include the cost of courseware or exam. Course is subject to a minimum enrollment to run. Course may run virtually as a Virtual Instructor-Led (VILT) class if the minimum enrollment is not met. If the course is under the minimum enrollment the course may run as 4 day class (Bootcamp Style). For more information, please contact learn@vtec.org or call 207-775-0244.
Risk management frameworks, cyber security framework, Control Objectives for Information and Related Technology (COBIT), International Organization for Standardization (ISO) 27001,
International Organization for Standardization (ISO) 31000)
System Development Life Cycle (SDLC)
Information system boundary requirements
Security controls and practices
Roles and responsibilities in the authorization/approval process
Understand risk management program processes
Select program management controls,Privacy requirements
Determine third-party hosted information systems, Understand regulatory and legal requirements
Familiarize with governmental, organizational and international regulatory security and privacy requirements, Federal Risk and Authorization Management Program (FedRAMP),
General Data Protection Regulation (GDPR), Health Insurance Portability and Accountability Act (HIPAA))
Familiarize with other applicable security-related mandates
Describe the architecture (e.g., data flow, internal and external interconnections)
Describe information system purpose and functionality
Determine categorization of the information system
Identify the information types processed, stored or transmitted by the information system
Determine the impact level on confidentiality, integrity, and availability for each information type (e.g., Federal Information Processing Standards (FIPS) 199,
International Organization for Standardization/ International Electrotechnical Commission (ISO/IEC) 27002,
data protection impact assessment)
Determine information system categorization and document results
Determine mandatory configuration settings and verify implementation in accordance with current industry standards (e.g. propriate organization entities (e.g., physical security,
Establish objectives and scope, Determine methods and level of effort
Determine necessary resources and logistics
Collect and review artifacts (e.g., previous assessments/audits, system documentation, policies)
Finalize the assessment/audit plan
Conduct assessment/audit, Collect and document assessment/audit evidence
Assess/audit implementation and validate compliance using approved assessment methods (e.g., interview, test and examine)
Prepare the initial assessment/audit report , Analyze assessment/audit results and identify vulnerabilities, Propose remediation actions
Review initial assessment/audit report and perform remediation actions, Determine risk responses, Apply remediations, Reassess and validate the remediated controls
Develop final assessment/audit report
Develop remediation plan, Analyze identified residual vulnerabilities or deficiencies, Prioritize responses based on risk level Identify resources and determine the appropriate timeframe/ schedule