Security Control Assessor Certificate Program

RMF Foundations: From Risk to Authorization

• Describe what the NIST RMF is for and how it ties risk to an authorization decision
• Recognize the principal RMF roles and what each one is accountable for
• Set a system's impact level using FIPS 199
• Choose and tailor a control baseline against NIST SP 800-53B
• Trace how controls are implemented, assessed, and documented
• Read an authorization decision and the residual risk it accepts
• Account for the part continuous monitoring plays in keeping an authorization current

NIST 800-53: Advanced Assessment, Tailoring, and Enterprise Program Management Course

• Advanced 800-53A assessment methodology, covering evidence sufficiency standards, determination statements, and assessment case mapping.
• Organization-Defined Parameter (ODP) tailoring with risk-based rationale and the documentation an Authorizing Official requires.
• Control overlays for specialized environments, including cloud, OT/ICS, AI/ML, and privacy-intensive systems.
• Automated assessment integration through SCAP, DISA STIGs, and vulnerability scanners alongside manual 800-53A evidence.
• Enterprise control inheritance architecture with Common Control Providers and cross-framework mapping to CSF, FedRAMP, and CMMC.
• Control program governance, covering ownership models, evidence management, metrics, and continuous improvement processes.

Security Control Assessor (SCA) Practitioner: The Assessment Lifecycle

• Explain an SCA's authority, independence, and exercise of professional judgment
• Set assessment scope and trace controls back to requirements
• Build a Security Assessment Plan and tailor SP 800-53A procedures to it
• Put examine, interview, and test methods to work effectively
• Weigh whether evidence is sufficient across control families and types
• Assess common, inherited, and hybrid controls
• Write up findings, determine control effectiveness, and produce a Security Assessment Report