Course Code: 19215

Certified Authorization Professional (CAP)

Class Dates:
11/14/2022
9/22/2022
Length:
5 Days
Cost:
$3495.00
Class Time:
Technology:
Business
Delivery:

Overview

  • Course Overview
  • The Certified Authorization Professional (CAP) training is aimed at providing knowledge and skills to professionals for maintaining and authorizing information system. This certification is significant to those responsible for establishing information security requirements and documentation along with formalizing risk assessment processes of an information security system. A CAP certified individual ensures the right level of security for information assets which are exposed to potential risk and damage.

    The CAP credential is meant for commercial markets, local and civilian government. Also, it is recognized by the U.S. Federal government including the DoD (Department of Defense) under Information Assurance and Management. This course is ideal for authorization officials, information security professionals, information owners and senior system managers

  • Audience
  • Who Should Attend
    The CAP is ideal for IT, information security and information assurance practitioners and contractors who use the RMF in:

    The U.S. federal government, such as the U.S. Department of State or the Department of Defense (DoD)
    The military
    Civilian roles, such as federal contractors
    Local governments
    Private sector organizations

Prerequisites

  • To qualify for the CAP certification, you must have:

    A minimum of two years cumulative, paid, full-time work experience
    In one or more of the seven domains of the CAP Common Body of Knowledge (CBK)

    To maintain certification, you must:
    Earn and post a minimum of 20 (ISC)2 CPE credits per year Comply with (ISC)2's Code of Professional Ethics

Course Disclaimer

*Course Cost listed does not include the cost of courseware or exam. Course is subject to a minimum enrollment to run. Course may run virtually as a Virtual Instructor-Led (VILT) class if the minimum enrollment is not met. If the course is under the minimum enrollment the course may run as 4 day class (Bootcamp Style). For more information, please contact learn@vtec.org or call 207-775-0244.

Course Details

  • DOMAIN 1: INFORMATION SECURITY RISK MANAGEMENT PROGRAM
  • Risk management frameworks, cyber security framework, Control Objectives for Information and Related Technology (COBIT), International Organization for Standardization (ISO) 27001,
  • International Organization for Standardization (ISO) 31000)
  • System Development Life Cycle (SDLC)
  • Information system boundary requirements
  • Security controls and practices
  • Roles and responsibilities in the authorization/approval process
  • Understand risk management program processes
  • Select program management controls,Privacy requirements
  • Determine third-party hosted information systems, Understand regulatory and legal requirements
  • Familiarize with governmental, organizational and international regulatory security and privacy requirements, Federal Risk and Authorization Management Program (FedRAMP),
  • General Data Protection Regulation (GDPR), Health Insurance Portability and Accountability Act (HIPAA))
  • Familiarize with other applicable security-related mandates
  • DOMAIN 2: SCOPE OF THE INFORMATION SYSTEM
  • Define the information system
  • Determine the scope of the information system
  • Describe the architecture (e.g., data flow, internal and external interconnections)
  • Describe information system purpose and functionality
  • Determine categorization of the information system
  • Identify the information types processed, stored or transmitted by the information system
  • Determine the impact level on confidentiality, integrity, and availability for each information type (e.g., Federal Information Processing Standards (FIPS) 199,
  • International Organization for Standardization/ International Electrotechnical Commission (ISO/IEC) 27002,
  • data protection impact assessment)
  • Determine information system categorization and document results
  • DOMAINE 3: SECTION AND APPROVAL OF SECUIRTY AND PRIVATE CONTROLS
  • Identify and document baseline and inherited controls 3.2 Select and tailor controls to the system
  • Determine applicability of recommended baseline and inherited controls
  • Determine appropriate use of control enhancements (e.g., security practices, overlays, countermeasures)
  • Document control applicability
  • Develop continuous control monitoring strategy (e.g., implementation, timeline, effectiveness)
  • Review and approve security plan/Information Security Management System (ISMS)
  • DOMAIN 4: IMPLEMENTATION OF SECURITY AND PRIVACY CONTROLS
  • Implement selected controls
  • Determine mandatory configuration settings and verify implementation in accordance with current industry standards (e.g. propriate organization entities (e.g., physical security,
  • personnel security, privacy)
  • DOMAIN 5: ASSESSMENT/AUDIT OF SECURITY AND PRIVACY CONTROLS
  • Prepare for assessment/audit
  • Determine assessor/auditor requirements
  • Establish objectives and scope, Determine methods and level of effort
  • Determine necessary resources and logistics
  • Collect and review artifacts (e.g., previous assessments/audits, system documentation, policies)
  • Finalize the assessment/audit plan
  • Conduct assessment/audit, Collect and document assessment/audit evidence
  • Assess/audit implementation and validate compliance using approved assessment methods (e.g., interview, test and examine)
  • Prepare the initial assessment/audit report , Analyze assessment/audit results and identify vulnerabilities, Propose remediation actions
  • Review initial assessment/audit report and perform remediation actions, Determine risk responses, Apply remediations, Reassess and validate the remediated controls
  • Develop final assessment/audit report
  • Develop remediation plan, Analyze identified residual vulnerabilities or deficiencies, Prioritize responses based on risk level Identify resources and determine the appropriate timeframe/ schedule
  • DOMAIN 6: AUTHORIZATION/APPROVAL OF INFORMATION SYSTEM
  • Compile security and privacy authorization/approval documents
  • Compile required security and privacy documentation to support authorization/approval decision by the designated official
  • Determine information system risk, Evaluate information system risk
  • Determine risk treatment options (i.e., accept, avoid, transfer, mitigate, share)
  • Determine residual risk
  • Authorize/approve information system
  • Determine terms of authorization/approval
  • DOMAIN 7: CONTINUOUS MONITORING
  • Determine impact of changes to information system and environment
  • Identify potential threat and impact to operation of information system and environment
  • Analyze risk due to proposed changes accounting for organizational risk tolerance
  • » Approve and document proposed changes (e.g., Change Control Board (CCB), technical review board)
  • Implement proposed changes
  • Validate changes have been correctly implemented
  • Ensure change management tasks are performed
  • .
  • Perform ongoing assessments/audits based on organizational requirements
  • Monitor network, physical and personnel activities (e.g., unauthorized assets, personnel and related activities)
  • Ensure vulnerability scanning activities are performed
  • Review automated logs and alerts for anomalies (e.g., security orchestration, automation and response)
  • Review supply chain risk analysis monitoring activities (e.g., cyber threat reports, agency reports, news reports)
  • Actively participate in response planning and communication of a cyber event
  • Ensure response activities are coordinated with internal and external stakeholders
  • Update documentation, strategies and tactics incorporating lessons learned
  • Revise monitoring strategies based on changes to industry developments introduced through legal, regulatory, supplier, security and privacy updates
  • Keep designated officials updated about the risk posture for continuous authorization/approval
  • Determine ongoing information system risk
  • Update risk register, risk treatment and remediation plan
  • .
  • Decommission information system
  • Determine information system decommissioning requirements
  • Communicate decommissioning of information system
  • Remove information system from operations
  • What you'll learn
  • Understanding the purpose of information systems security authorization
  • Defining systems authorization
  • Describing and decide when systems authorization is employed
  • Defining roles and responsibilities
  • Understanding the legal and regulatory requirements for A&A
  • Initiating the authorization process
  • Establishing authorization boundaries
  • Determining security categorization
  • Performing initial risk assessment
  • Selecting and refining security control
  • Documenting security control
  • Performing certification phase
  • .
  • Assessing security control
  • Documenting results
  • Conducting final risk assessment
  • Generating and presenting an authorization report
  • Performing continuous monitoring
  • Monitoring security controls
  • Monitoring and assessing changes that affect the information system
  • Performing security impact assessment as needed
  • Documenting and monitoring results of impact assessments
  • Maintaining system’s documentation (e.g., POA&M, SSP, interconnection agreements)