DoD Risk Management Framework (RMF) Boot Camp

Infosec offers the most in-depth course available for students looking to learn about the Risk Management Framework for DoD Information Technology. Risk Management Framework (RMF) describes the DoD process for identifying, implementing, assessing, and managing cybersecurity capabilities and services, expressed as security controls, and authorizing the operation of Information Systems (IS) and Platform Information Technology (PIT) systems.

RMF brings a risk-based approach to the implementation of cybersecurity, supports cybersecurity integration early and throughout the system lifecycle, promotes reciprocity to the maximum extent possible and stresses continuous monitoring. RMF replaces the DoD Information Assurance Certification and Accreditation Process (DIACAP) and adopts the term cybersecurity in place of information assurance.

Objectives

After completing the Infosec’s DoD RMF Boot Camp, participants will be able to:

• Understand the Risk Management Framework for DoD IT Authorization process
• Understand FISMA and NIST processes for authorizing Federal IT systems
• Explain key roles and responsibilities
• Explain statutory and regulatory requirements
• Apply these principles to real-world activities and situations

This boot camp course blends lecture, discussion, and hands-on exercises to educate students on RMF methodology. Students will be prepared to implement the Risk Management Framework for their IT systems as prescribed in the updated DoD series of publications, as well as the related NIST and CNSS publications. The workshop covers transition from the DoD C&A process (DIACAP) to RMF and explains methodology for categorizing information systems, selecting and implementing applicable security controls, and establishing a Continuous Monitoring program. This workshop breaks down the DoD Instruction 8510.01 (RMF for DoD IT) into steps, tasks, outputs, and responsible entities and includes informative lectures, discussions, and exercises which provide a functional understanding of Cybersecurity, Risk Management, and the proper selection, implementation, and validation of the new Security Controls as outlined on the RMF Knowledge Service and corresponding NIST Special Publications.