CASp study guide
CASp · Work through your exam, one topic at a time.
The Certified Authorization Professional (CAP) is an ISC2 credential aimed at the people who shepherd information systems through a formal authorization lifecycle: security officers, ISSOs and ISSMs, risk analysts, control assessors, and auditors working in or with government and regulated environments. Its subject matter is the risk management framework as a process rather than a set of products - categorizing a system, choosing and tailoring controls, implementing and assessing them, assembling an authorization package, and then keeping the authorization alive through continuous monitoring. The CASp study guide has 7 sections and about 1,960 words.
01Information Security Risk Management Framework
The Risk Management Framework (RMF) is a disciplined, repeatable process for integrating security and privacy into the system development life cycle. A candidate should know that RMF is not a one-time approval event but a lifecycle that runs from concept through disposal, and that its steps map to the six later domains: categorize, select, implement, assess, authorize, and monitor.
324 words, about 2 min02Categorization of Information Systems
Categorization determines the potential impact of a loss of confidentiality, integrity, and availability on organizational operations, assets, individuals, and other organizations. The result is a system security category expressed as high-water mark across the three objectives, for example a system rated moderate because one objective is moderate even if the others are low.
276 words, about 1 min03Selection of Security Controls
Control selection begins with a baseline appropriate to the system's category, then applies tailoring: scoping out controls that do not apply, compensating for controls that cannot be implemented as written, and supplementing with additional controls. The result is documented in the system security plan.
287 words, about 1 min04Implementation of Security Controls
Implementation turns selected controls into operating reality. Key concepts include the system security plan, which documents how each control is implemented or why it is not; configuration management, which keeps implementations consistent; and the separation of duties that prevents one person from designing, implementing, and approving the same control.
276 words, about 1 min05Assessment of Security Controls
Assessment determines whether controls are implemented correctly, operating as intended, and producing the desired outcome. Candidates should know the three assessment methods: examine, interview, and test.
264 words, about 1 min06Authorization of Information Systems
The authorization decision is the AO's formal acceptance of residual risk based on the assessment evidence, the system security plan, and the plan of action and milestones. Candidates should understand that authorization is a risk decision, not a technical verdict, and that it can be granted, granted with conditions, or denied.
276 words, about 1 min07Continuous Monitoring
Continuous monitoring maintains ongoing awareness of the security posture, vulnerabilities, and threats so that risk decisions stay current. Candidates should know its components: configuration management, control monitoring, security impact analysis of changes, and ongoing assessment of selected controls.
257 words, about 1 min