CAP (The American College Credentials) study plan

Diagram the six RMF steps in order, labeling the primary inputs, outputs, and accountable role at each step.

Differentiate the duties of the authorizing official, system owner, ISSO, security control assessor, and common control provider in a side-by-side comparison table.

Match FISMA, OMB policy, and NIST SP 800-37 Rev. 2 guidance to the obligation each imposes on an agency RMF program.

Explain how RMF tasks are woven into SDLC phases and where an authorization boundary is drawn for a sample system.

Apply FIPS 199 to rate confidentiality, integrity, and availability impact as low, moderate, or high for three distinct information types.

Derive an overall system impact level with the high-water mark rule and justify any adjustment for special factors such as privacy or national security.

Map SP 800-60 information types to a sample system and record the difference between provisional and final categorization.

Defend a completed categorization in a five-minute spoken briefing as if presenting to an authorizing official.

Recall the FIPS 200 minimum security requirements and the SP 800-53 Rev. 5 control families without notes.

Compare the low, moderate, and high baselines in SP 800-53B and explain how individual controls are added, elevated, or removed between them.

Tailor a baseline by applying scoping, compensating control, and common control decisions, annotating the rationale for each change.

Justify the choice of an available overlay or a FedRAMP baseline for a given deployment scenario.

Assign each selected control as common, hybrid, or system-specific and name the party responsible for implementing it.

Write implementation statements covering what is done, where it is done, and how it is done for 15 controls in a system security plan section.

Apply STIG or SCAP checklist results and hardened configuration settings to confirm that a control is actually implemented as described.

Trace any sampled control from baseline selection through implementation to its SSP entry to prove there are no gaps.

Translate SP 800-53A assessment objectives into a security assessment plan that specifies examine, interview, or test methods per control.

Write assessment procedures and satisfied or other-than-satisfied determination statements for 10 controls.

Apply sampling logic and assessor independence requirements to two realistic scenarios and state the correct course of action.

Draft security assessment report findings with severity ratings and supporting evidence citations.

Assemble a complete authorization package and identify the author and reviewer of each artifact in it.

Distinguish a full authorization to operate, an authorization with conditions, an interim authorization to test, and a denial for four different risk scenarios.

Build a plan of action and milestones for identified weaknesses with milestones, assigned resources, and risk acceptance sign-off.

Explain how the authorizing official's decision depends on the assessment report, the plan of action and milestones, and organizational risk tolerance.

Design an information security continuous monitoring strategy aligned to SP 800-137 that states what is monitored, how often, and by whom.

Set monitoring frequencies and metrics for configuration management, vulnerability scanning, and plan of action and milestones tracking.

Explain how ongoing authorization depends on continuous assessment results and on defined change triggers that force reassessment.

Trace an escalation path from a single scan finding through to a potential reauthorization trigger.

Re-derive the end-to-end RMF flow for the fictional system using only the artifacts produced in weeks 1 through 7.

Re-quiz every item missed on the week-2 and week-4 milestone checks until each is answered correctly twice.

Complete two timed practice exams of at least 125 questions each and log every missed item by domain and sub-topic.