CAP (The American College Credentials) case studies
CAP · Put your knowledge to work in context.
The Certified Authorization Professional (CAP) is an ISC2 credential aimed at the governance, risk and compliance side of security: the people who take a system through a formal authorization lifecycle rather than configure firewalls. Typical candidates are security assessors and control testers, information system security officers, risk analysts, auditors, privacy and compliance staff, and the advisors who prepare authorization packages for an authorizing official. The CAP case studies are 5 cases and about 3,322 words.
1Categorization Dispute for a Consolidated HR and Benefits Platform
An agency is consolidating three legacy systems into a single HR-Benefits platform. The program office proposes a Moderate categorization because most users and records are administrative.
770 words, about 4 min2Tailoring a Moderate Baseline for a Cloud-Hosted Case Management System
An agency is moving a case-management system to a CSP's FedRAMP Moderate IaaS/PaaS offering. The CSP package lists 45 controls as inherited, 80 as hybrid, and 25 as customer-responsible.
645 words, about 3 min3Implementation Status of MFA and Configuration Baselines on a Legacy Claims Portal
The system owner of a legacy claims portal reports IA-2(1) as 'Implemented' in the SSP. Evidence shows 1,200 internal users authenticate through the agency SSO with MFA, but 34 external claims adjusters use local portal accounts with passwords only because the portal cannot consume SAML assertions.
643 words, about 3 min4Assessor Finding on Account Management and Stale Inherited Audit Evidence
An independent assessment of a Moderate system samples 25 of 600 accounts for AC-2. Twenty-three have documented authorization and review within 90 days.
627 words, about 3 min5Authorization Decision After a Critical Vulnerability and Unapproved Cloud Replication
A system has an ATO expiring in 30 days. The monthly ConMon scan finds a CVSS 9.8 remote-code-execution vulnerability in an internet-facing component; the vendor patch is 21 days away.
637 words, about 3 min