CAP (The American College Credentials) study guide
CAP · Work through your exam, one topic at a time.
The Certified Authorization Professional (CAP) is an ISC2 credential aimed at the governance, risk and compliance side of security: the people who take a system through a formal authorization lifecycle rather than configure firewalls. Typical candidates are security assessors and control testers, information system security officers, risk analysts, auditors, privacy and compliance staff, and the advisors who prepare authorization packages for an authorizing official. The CAP study guide has 7 sections and about 2,101 words.
01Risk Management Framework (RMF)
The Risk Management Framework (RMF) is NIST's disciplined, risk-based process for integrating security, privacy, and supply-chain risk management into the system development life cycle. Under SP 800-37 Revision 2 it has seven steps: Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor.
291 words, about 1 min02Categorization of Information Systems
Categorization answers one question: what is the potential impact on the organization if confidentiality, integrity, or availability of the system and its information is compromised? FIPS 199 defines three impact levels-low (limited adverse effect), moderate (serious adverse effect), and high (severe or catastrophic adverse effect).
306 words, about 2 min03Selection of Security Controls
FIPS 200 establishes minimum security requirements, and SP 800-53 provides the control catalog. SP 800-53B supplies low, moderate, and high baselines.
309 words, about 2 min04Implementation of Security Controls
Implementation turns the selected control set into operating reality across people, processes, and technology. Controls are allocated to system components, common control providers, or hybrid arrangements.
292 words, about 1 min05Assessment of Security Controls
Assessment determines whether selected controls are implemented correctly, operating as intended, and producing the desired outcome. SP 800-53A provides assessment objectives and procedures.
290 words, about 1 min06Authorization of Information Systems
Authorization is the AO's formal decision to accept residual risk and permit system operation. The AO reviews the authorization package: the SSP, SAR, POA&M, and continuous monitoring strategy.
324 words, about 2 min07Continuous Monitoring
The Monitor step keeps authorization valid by continuously understanding security and privacy posture. SP 800-137 describes information security continuous monitoring (ISCM): a strategy, metrics, data collection, analysis, reporting, and response.
289 words, about 1 min