Overview

The full federal authorization credential on the assessor track. Participants build out the whole Risk Management Framework core — categorizing systems, selecting and documenting SP 800-53 controls, running continuous monitoring — and then specialize in the independent assessment craft: advanced 800-53A technique and the end-to-end work of planning, running, and documenting a security control assessment that holds together. Aligns to NIST SP 800-37, 800-53 Rev 5, 800-53A, 800-137, and the NICE ISSO/ISSM and Security Control Assessor work roles.

Prepares you for: security control assessor and 3PAO assessor roles, and preparation toward the ISC2 CGRC. Working the cloud side instead? See Federal Cybersecurity Authorization Professional: Cloud & FedRAMP Authorization.

Syllabus

RMF Foundations: From Risk to Authorization

Describe what the NIST RMF is for and how it ties risk to an authorization decision
Recognize the principal RMF roles and what each one is accountable for
Set a system's impact level using FIPS 199
Choose and tailor a control baseline against NIST SP 800-53B
Trace how controls are implemented, assessed, and documented
Read an authorization decision and the residual risk it accepts
Account for the part continuous monitoring plays in keeping an authorization current

NIST 800-53: Control Selection, Implementation, and Security Planning Course

Baseline selection and tailoring drawn from NIST SP 800-53B, covering scoping guidance, compensating controls, and organization-defined parameters.
SSP implementation statements for the AC, IA, AU, CM, IR, and SC control families that satisfy 800-53A evidence sufficiency standards.
Privacy controls and Supply Chain Risk Management (SR) family requirements for the federal systems they apply to.
Assessment readiness through 800-53A procedures, covering evidence collection standards and finding severity classification.
POA&M development with milestone tracking, resource estimates, and a clear link to FISMA reporting.

FISMA & Continuous Monitoring Fundamentals Course

Explain how FISMA assigns accountability and structures oversight
Design an ISCM strategy that aligns to NIST SP 800-137
Put asset, configuration, and vulnerability visibility in place
Keep control assessment and supporting evidence current
Produce security metrics and risk reporting aimed at leadership
Work findings and POA&Ms in priority order, driven by risk
Describe ongoing authorization and how an ISCM program gets evaluated

NIST 800-53: Advanced Assessment, Tailoring, and Enterprise Program Management Course

Advanced 800-53A assessment methodology, covering evidence sufficiency standards, determination statements, and assessment case mapping.
Organization-Defined Parameter (ODP) tailoring with risk-based rationale and the documentation an Authorizing Official requires.
Control overlays for specialized environments, including cloud, OT/ICS, AI/ML, and privacy-intensive systems.
Automated assessment integration through SCAP, DISA STIGs, and vulnerability scanners alongside manual 800-53A evidence.
Enterprise control inheritance architecture with Common Control Providers and cross-framework mapping to CSF, FedRAMP, and CMMC.
Control program governance, covering ownership models, evidence management, metrics, and continuous improvement processes.

Security Control Assessor (SCA) Practitioner: The Assessment Lifecycle

Explain an SCA's authority, independence, and exercise of professional judgment
Set assessment scope and trace controls back to requirements
Build a Security Assessment Plan and tailor SP 800-53A procedures to it
Put examine, interview, and test methods to work effectively
Weigh whether evidence is sufficient across control families and types
Assess common, inherited, and hybrid controls
Write up findings, determine control effectiveness, and produce a Security Assessment Report