CAP (ABRET) case studies
CAP · Put your knowledge to work in context.
The CGRC (Governance, Risk and Compliance Certification, formerly known as CAP) is an ISC2 credential that, in ISC2's words, "Shows advanced technical skills and knowledge to protect, authorize and maintain information systems within various risk management frameworks." It is aimed at IT, information security and information assurance practitioners working in GRC roles who need to understand, apply or implement a risk management program for IT systems. ISC2 lists typical job titles including cybersecurity auditor, compliance officer, GRC analyst, GRC manager, GRC architect, third-party risk manager, enterprise risk manager and information assurance manager. The CAP case studies are 5 cases and about 3,370 words.
1The Acquired Subsidiary and the 90-Day Attestation
Northbridge Health System completed its acquisition of a 40-clinician telehealth subsidiary nine months ago. The subsidiary runs its own SaaS EHR on a vendor-hosted platform, holds a SOC 2 Type II report with a nine-month evidence gap, and self-certifies against HIPAA.
639 words, about 3 min2The Payment Portal Boundary That Excluded the Identity Provider
Meridian Payments runs a customer-facing payment portal on AWS. The authorization boundary diagram submitted to the assessor shows only three EC2 web servers and one RDS database.
668 words, about 3 min3Choosing One Framework for CUI, ISO Certification, and Privacy
A defense contractor's new logistics system must satisfy DFARS 252.204-7012 (NIST SP 800-171), an ISO/IEC 27001 certification required by a commercial customer, and an internal privacy standard aligned to the NIST Privacy Framework. The system processes controlled unclassified information and personal data for 8,000 employees.
618 words, about 3 min4The Legacy Claims Application and the Compensating Control
A state unemployment agency is implementing NIST SP 800-53 Moderate controls for a benefits portal. The identity team deployed multifactor authentication for 82% of staff, but 240 caseworkers still use a legacy claims application that cannot support SAML.
624 words, about 3 min5The Assessment With 265 Not-Applicable Controls
An independent assessment team has completed a NIST SP 800-53 Rev. 5 assessment of a law enforcement evidence-management system.
821 words, about 4 min