CAP (ABRET) study plan
CAP · Give each week a clear focus.
8 weeks · About 7 hours per week
Security and Privacy Governance, Risk Management, and Compliance Program & Scope of the System
Map every task and knowledge statement in Domains 1 and 2 to a one-line definition in your own words
Draft a system boundary diagram for a fictional or sanitized real system, marking people, processes, technology, and data flows
Distinguish authorization boundary, system boundary, and environment of operation using three concrete examples
List the roles in a governance structure (authorizing official, system owner, ISSO, privacy officer) and state each role's decision rights
Your checkpoint
A two-page Domain 1-2 concept map plus a labeled system boundary diagram with a written scope justification
Security and Privacy Governance, Risk Management, and Compliance Program
Categorize a sample system as low, moderate, or high impact for confidentiality, integrity, and availability, and write the rationale for each
Build a risk register with at least eight entries, each with likelihood, impact, and a chosen response
Compare risk treatment options and justify accept, mitigate, transfer, or avoid for each register entry
Explain how privacy risk differs from security risk and where the two overlap in a compliance program
Your checkpoint
A completed risk register with eight or more entries, categorization rationale, and a one-paragraph privacy risk narrative
Selection and Approval of Framework, Security, and Privacy Controls
Select a control framework and document why it fits the system's categorization and mission
Trace at least ten controls from a selected baseline to their source control families and note any tailoring
Write tailoring and supplementation decisions for five controls, stating the justification for each
Identify where common controls are inherited and record the inheritance in a control matrix
Your checkpoint
A control selection worksheet covering ten or more controls with baseline source, tailoring decision, and inheritance notes
Implementation of Security and Privacy Controls
Write implementation statements for the ten selected controls, naming the responsible role and the mechanism used
Produce a control implementation table that maps each control to a policy, process, or technology artifact
Draft one system security and privacy plan section that describes how a control is implemented and monitored
Identify three implementation gaps and assign an owner and target date to each
Your checkpoint
A control implementation table for ten controls plus a gap log with owners and target dates
Assessment/Audit of Security and Privacy Controls
Design an assessment plan with scope, sampling approach, methods (examine, interview, test), and evidence requests
Write assessment objectives and determine the assessment method for at least eight controls
Conduct a tabletop assessment of three controls and record findings with evidence references
Draft findings in a format that states condition, criteria, cause, and effect
Your checkpoint
An assessment plan plus three completed assessment records with evidence references and condition-criteria-cause-effect findings
System Compliance
Assemble an authorization package checklist and state what each artifact must contain
Interpret assessment results to recommend authorization, authorization with conditions, or denial, with reasoning
Write a plan of action and milestones for each open finding, including severity and remediation timeline
Explain continuous monitoring requirements that follow an authorization decision
Your checkpoint
A mock authorization decision memo with a supporting plan of action and milestones for all open findings
Compliance Maintenance & Security and Privacy Governance, Risk Management, and Compliance Program
Build a continuous monitoring calendar covering control assessments, vulnerability scans, and configuration reviews
Define change management triggers that require reassessment of controls or scope
Draft three compliance metrics with data source, frequency, and threshold for escalation
Describe how to decommission a system or control while preserving evidence and closing findings
Your checkpoint
A continuous monitoring calendar with three compliance metrics and an evidence retention note
Security and Privacy Governance, Risk Management, and Compliance Program & Scope of the System & Selection and Approval of Framework, Security, and Privacy Controls & Implementation of Security and Privacy Controls & Assessment/Audit of Security and Privacy Controls & System Compliance & Compliance Maintenance
Complete two timed practice sets and log every missed item by domain
Re-study the two weakest domains using your own notes and rewrite each missed concept in one sentence
Recite the authorization lifecycle from categorization through continuous monitoring without notes
Build a one-page exam-day reference sheet of role definitions, control families, and assessment methods
Your checkpoint
A scored practice log by domain, a rewritten weak-concept list, and a one-page exam-day reference sheet
Milestones
Week 2: Can categorize an unfamiliar system and justify the result for all three security objectives, and can produce a risk register entry unaided
Week 4: Can move from a selected baseline to a written implementation statement for any control without referring to notes
Week 6: Can read assessment findings and produce a defensible authorization recommendation with a complete plan of action and milestones
Week 8: Scores above 80 percent on timed practice sets and can explain every missed item in one sentence