Overview

The Risk Management Framework is how federal information systems get secured and authorized. This program carries a practitioner from the core RMF lifecycle through hands-on control selection and into the continuous monitoring that holds an authorization in place over time. It aligns to NIST SP 800-37, SP 800-53 Rev 5, SP 800-53B, and SP 800-137, and to the NICE work roles for Information System Security Officer and Manager.

Prepares you for: the ISSO/ISSM role and foundational preparation toward the ISC2 CGRC (Certified in Governance, Risk and Compliance).

Syllabus

RMF Foundations: From Risk to Authorization

Describe what the NIST RMF is for and how it ties risk to an authorization decision
Recognize the principal RMF roles and what each one is accountable for
Set a system's impact level using FIPS 199
Choose and tailor a control baseline against NIST SP 800-53B
Trace how controls are implemented, assessed, and documented
Read an authorization decision and the residual risk it accepts
Account for the part continuous monitoring plays in keeping an authorization current

NIST 800-53: Control Selection, Implementation, and Security Planning Course

Baseline selection and tailoring drawn from NIST SP 800-53B, covering scoping guidance, compensating controls, and organization-defined parameters.
SSP implementation statements for the AC, IA, AU, CM, IR, and SC control families that satisfy 800-53A evidence sufficiency standards.
Privacy controls and Supply Chain Risk Management (SR) family requirements for the federal systems they apply to.
Assessment readiness through 800-53A procedures, covering evidence collection standards and finding severity classification.
POA&M development with milestone tracking, resource estimates, and a clear link to FISMA reporting.

FISMA & Continuous Monitoring Fundamentals Course

Explain how FISMA assigns accountability and structures oversight
Design an ISCM strategy that aligns to NIST SP 800-137
Put asset, configuration, and vulnerability visibility in place
Keep control assessment and supporting evidence current
Produce security metrics and risk reporting aimed at leadership
Work findings and POA&Ms in priority order, driven by risk
Describe ongoing authorization and how an ISCM program gets evaluated

Contingency Planning and Cyber Resilience Course

Explain the seven-step NIST contingency planning process and what each step produces.
Distinguish business continuity, disaster recovery, and incident response plans and identify when each applies.
Conduct a business impact analysis to identify critical systems and set recovery objectives.
Set a recovery time objective and a recovery point objective for a given system.
Select preventive controls that reduce the likelihood or impact of a disruption.
Compare backup and alternate site strategies and choose one that fits a stated budget and risk tolerance.
Apply recovery strategy considerations specific to cyber incidents, including ransomware.
Draft the core sections of a contingency plan document, including activation and recovery procedures.
Write a recovery procedure clear enough for someone unfamiliar with the system to follow.
Distinguish tabletop, walkthrough, and functional exercises and select the right one for a given organization.
Identify events that should trigger a contingency plan update.
Explain how an individual contingency plan supports a broader organizational cyber resilience program.
Evaluate a contingency plan document for missing or vague sections.