Certified Authorization Professional (CAP)

Domain 1: Risk Management Framework (RMF)

Understanding the NIST Risk Management Framework and its application to federal information systems.

• NIST RMF steps and lifecycle
• Federal information security laws (FISMA)
• Security categorization using FIPS 199
• System authorization boundaries

Domain 2: Categorization of Information Systems

• FIPS 199 security categories
• Impact levels (Low, Moderate, High)
• System boundary definition
• Documenting system characteristics

Domain 3: Selection of Security Controls

• NIST SP 800-53 control families
• Baseline security controls selection
• Tailoring and scoping controls
• Control overlays and enhancements

Domain 4: Implementation of Security Controls

• Security control implementation planning
• Configuration management
• Supply chain risk management
• Documentation of control implementation

Domain 5: Assessment of Security Controls

• Security assessment planning
• Assessment methods and procedures
• Assessment findings and evidence
• Security assessment report (SAR)

Domains 6-7: Authorization & Continuous Monitoring

• Plan of action and milestones (POA&M)
• Authorization decision packages
• Ongoing authorization concepts
• Continuous monitoring strategy and tools