Infosec’s Certified Authorization Professional (CAP) Boot Camp prepares students for the CAP exam through extensive mentoring and drill sessions, review of all 7 CAP domains of knowledge, and practical question and answer scenarios, all through a high-energy seminar approach.

The Certified Authorization Professional (CAP) credential applies to professionals who need to setup the formal processes used to assess risk and establish security requirements based on regulatory standards. The credential is sought after by civilian, state and local governments, as well as system integrators supporting these organizations.

• Three days of training with an expert instructor
• Infosec digital courseware (physical textbooks available to purchase)
• CAP exam voucher
• 90-day access to course replays (Flex Pro)
• Curated videos from other top-rated instructors (add-on)
• 100% Satisfaction Guarantee
• Exam Pass Guarantee (Flex Pro)

Infosec’s courseware materials are always up to date and synchronized with the latest exam objectives. Our industry-leading curriculum and expert instructors have led to the highest pass rates in the industry. More than 93% of Infosec students pass their certification exams on their first attempt.

Employees who perform functions such as authorization officials, system owners, information owners, information system security officers, and certifiers as well as all senior system managers can benefit from this training, including:

• System Administrators
• Information Security Professionals
• Anyone involved in a NIST-based information systems security authorization process. Manage security, including basic firewall and SELinux configuration

To achieve the CAP credential, you need a minimum of two years of direct full-time information systems security authorization professional experience in one or more of these seven (ISC)² CAP domains:

• Risk Management Framework (RMF)
• Categorization of Information Systems
• Selection of Security Controls
• Security Control Implementation
• Security Control Assessment
• Information System Authorization
• Monitoring of Security Controls

Upon completing our 3-day CAP Boot Camp you will gain valuable knowledge and skills including:

• Understanding the purpose of information systems security authorization
• Defining systems authorization
• Describing and decide when systems authorization is employed
• Defining roles and responsibilities
• Understanding the legal and regulatory requirements for A&A
• Initiating the authorization process
• Establishing authorization boundaries
• Determining security categorization
• Performing initial risk assessment
• Selecting and refining security controls
• Documenting security control

• Performing certification phase
• Assessing security control
• Documenting results
• Conducting final risk assessment
• Generating and presenting an authorization report
• Performing continuous monitoring
• Monitoring security controls
• Monitoring and assessing changes that affect the information system
• Performing security impact assessment as needed
• Documenting and monitoring results of impact assessments
• Maintaining system’s documentation (e.g., POA&M, SSP, interconnection agreements)

Introduction
Risk management framework

• Understanding the risk management framework
• Categorization of information system
• Selection of security controls
• Security control implementation
• Security control assessment
• Information system authorization
• Monitoring of security controls

RMF steps

• Risk management framework processes
• Categorize information system
  • Information system
  • System security plan
  • Categorize a system
  • National security system
  • Privacy activities
  • System boundaries
  • Register system
• Select security controls
  • Establish the security control baseline
  • Common controls and security controls inheritance
  • Risk assessment as part of the risk management framework (RMF)

• Implement security controls
  • Implement selected security controls
  • Tailoring of security controls
  • Document security control implementation
• Assess security controls
  • Prepare for security control assessment
  • Establish security control assessment plan (SAP)
  • Determine security control effectiveness – perform the testing
  • Develop initial security assessment report (SAR)
  • Perform initial remediation actions
  • Develop final security assessment report and addendum
• Authorize information system
  • Develop plan of action and milestones (POAM)
  • Assemble security authorization package
  • Determine risk
  • Determine the acceptability of risk
  • Obtain security authorization decision
• Monitor security state
  • Determine security impact of changes to system and environment
  • Perform ongoing security control assessments
  • Conduct ongoing remediation actions
  • Update key documentation
  • Perform periodic security status reporting
  • Perform ongoing risk determination and acceptance
  • Decommission and remove system