CAP1 case studies
CAP1 · Put your knowledge to work in context.
The Certified Authorization Professional - now delivered by ISC2 under the Governance, Risk and Compliance (CGRC) name - is a credential for practitioners who shepherd systems through the authorization process: scoping a system, selecting and approving controls, overseeing implementation, assessing those controls, supporting the authorizing official's decision, and keeping the authorization alive through continuous monitoring. It sits squarely in the governance, risk and compliance lane rather than the hands-on engineering lane, so it appeals to ISSOs, security control assessors, risk analysts, compliance and audit staff, and program managers who interface with an authorizing official. The CAP1 case studies are 5 cases and about 2,720 words.
1The Exception That Outlived Its Owner
A bureau's legacy case-management system serves 3,200 users and runs on a database version the vendor stopped supporting 14 months ago. The system owner requests a 12-month exception to the encryption-at-rest requirement, arguing no supported patch exists.
474 words, about 2 min2Where Does the Boundary End?
A grants management system serves 400,000 applicants and holds PII plus banking data. The front end is a vendor-hosted multi-tenant SaaS; the vendor holds a Moderate authorization from another agency.
594 words, about 3 min3Inherited on Paper Only
Fourteen agency systems are consolidating into a shared datacenter. The datacenter team publishes a common control catalog claiming 62 controls - physical access, boundary protection, malware defense, backup.
578 words, about 3 min4The Sample That Proved Nothing
A 900-user benefits system uses manual account provisioning: two administrators maintain a spreadsheet and receive a weekly HR termination feed by email. The control statement requires accounts be disabled within 24 hours of termination.
535 words, about 3 min5The Upgrade Nobody Flagged
A system holding controlled unclassified information has an authorization with annual assessment and quarterly scanning. In March the team migrates to a new cloud region, replaces its commercial database with an open-source one, and enables a public API for mobile clients.
539 words, about 3 min