Federal Cybersecurity Authorization Professional: Cloud & FedRAMP Authorization Certificate Program

Overview

The full federal authorization credential on the cloud track. Participants build out the whole RMF core, then specialize in the FedRAMP world: cloud security fundamentals, the agency authorization process, deep package due diligence and continuous-monitoring oversight, and the transition to FedRAMP 20x under the Consolidated Rules for 2026. Aligns to NIST SP 800-37, 800-53 Rev 5, 800-137, FedRAMP, and the shared responsibility model; the modernization content is timed to the CR26 mandatory date of January 1, 2027.

Prepares you for: federal cloud authorization roles, and preparation toward the ISC2 CCSP and CSA CCSK. Working the assessor side instead? See Federal Cybersecurity Authorization Professional: Security Control Assessor.

Syllabus

RMF Foundations: From Risk to Authorization

Describe what the NIST RMF is for and how it ties risk to an authorization decision
Recognize the principal RMF roles and what each one is accountable for
Set a system's impact level using FIPS 199
Choose and tailor a control baseline against NIST SP 800-53B
Trace how controls are implemented, assessed, and documented
Read an authorization decision and the residual risk it accepts
Account for the part continuous monitoring plays in keeping an authorization current

NIST 800-53: Control Selection, Implementation, and Security Planning Course

Baseline selection and tailoring drawn from NIST SP 800-53B, covering scoping guidance, compensating controls, and organization-defined parameters.
SSP implementation statements for the AC, IA, AU, CM, IR, and SC control families that satisfy 800-53A evidence sufficiency standards.
Privacy controls and Supply Chain Risk Management (SR) family requirements for the federal systems they apply to.
Assessment readiness through 800-53A procedures, covering evidence collection standards and finding severity classification.
POA&M development with milestone tracking, resource estimates, and a clear link to FISMA reporting.

FISMA & Continuous Monitoring Fundamentals Course

Explain how FISMA assigns accountability and structures oversight
Design an ISCM strategy that aligns to NIST SP 800-137
Put asset, configuration, and vulnerability visibility in place
Keep control assessment and supporting evidence current
Produce security metrics and risk reporting aimed at leadership
Work findings and POA&Ms in priority order, driven by risk
Describe ongoing authorization and how an ISCM program gets evaluated

Cloud Security Fundamentals for Federal Employees

Describe cloud service models and the core concepts behind federal cloud use
Explain what FedRAMP does within federal cloud governance
Put the shared responsibility model to work against real scenarios
Identify the essential identity, access, and data-protection practices in the cloud
Describe secure configuration and vulnerability management
Explain cloud monitoring, incident reporting, and risk response

FedRAMP for Agency Buyers: Authorization Process and Cloud Service Selection Course

FedRAMP authorization framework, covering JAB versus Agency ATO paths, impact levels, and the FedRAMP Marketplace.
Security package review: weighing SSPs, SARs, and POA&Ms for cloud service selection and risk acceptance.
Shared responsibility and control inheritance documentation between agencies and cloud service providers.
Agency ATO development for FedRAMP-authorized services, covering residual risk identification and AO risk acceptance.
FedRAMP continuous monitoring obligations, covering monthly vulnerability scans, significant change notifications, and annual assessments.
Cloud incident response under FedRAMP shared obligations, including US-CERT notification and CSP coordination.

FedRAMP for Agency Buyers: Package Due Diligence and Cloud Security Program Management Course

Authorization package due diligence: SSP and SAR analysis, penetration test report review, and POA&M health assessment.
Customer Responsibility Matrix engineering: spotting inherited control gaps and writing agency supplemental documentation.
Agency ATO documentation for FedRAMP-leveraged systems, covering residual risk assessment and interconnection documentation.
FedRAMP continuous monitoring program design, covering CSP deliverable oversight, significant change notifications, and escalation procedures.
Enterprise cloud security governance, covering portfolio risk aggregation, vendor management, and executive-level reporting.
Procurement strategy and contractual cloud security protections, covering incident response SLAs, data portability, and supply chain risk provisions.