CASp case studies
CASp · Put your knowledge to work in context.
The Certified Authorization Professional (CAP) is an ISC2 credential aimed at the people who shepherd information systems through a formal authorization lifecycle: security officers, ISSOs and ISSMs, risk analysts, control assessors, and auditors working in or with government and regulated environments. Its subject matter is the risk management framework as a process rather than a set of products - categorizing a system, choosing and tailoring controls, implementing and assessing them, assembling an authorization package, and then keeping the authorization alive through continuous monitoring. The CASp case studies are 5 cases and about 2,772 words.
1The Legacy Billing System That Cannot Be Categorized
A federal agency operates a 22-year-old mainframe billing system that processes 1.4 million transactions nightly. The system owner proposes categorizing it as Moderate confidentiality, Low integrity, Low availability because 'the data is mostly internal.' However, the system feeds disbursement files directly to Treasury, and a two-hour outage last quarter triggered a manual reconciliation costing $340,000.
548 words, about 3 min2Baseline Tailoring Under a Tight Budget
A Moderate-baseline system supporting a grants-management mission must be assessed in 90 days. The security team has 1,200 labor hours available and estimates full implementation of the baseline at 2,600 hours.
537 words, about 3 min3Assessment Sampling That Hides a Failure
An assessor is evaluating a Moderate system with 325 applicable controls. To fit a 40-hour assessment window, the team samples 60 controls and reports 57 satisfied, 3 other-than-satisfied.
550 words, about 3 min4Continuous Monitoring That Monitors Nothing
A system received a three-year authorization 18 months ago. Its continuous monitoring plan specifies monthly vulnerability scans, quarterly configuration baselines checks, annual control assessments of 30% of controls, and monthly review of audit logs.
548 words, about 3 min5Risk Acceptance When the Owner and the AO Disagree
A system has completed assessment with two High-risk findings: an unpatched remote-code-execution vulnerability in an internet-facing component, and a lack of multi-factor authentication for administrative access. The system owner argues both are acceptable because the component is behind a web application firewall and administrators are 'trusted, long-tenured staff.' Remediation for the first is estimated at three weeks; MFA at six weeks.
589 words, about 3 min