CAP1 study guide
CAP1 · Work through your exam, one topic at a time.
The Certified Authorization Professional - now delivered by ISC2 under the Governance, Risk and Compliance (CGRC) name - is a credential for practitioners who shepherd systems through the authorization process: scoping a system, selecting and approving controls, overseeing implementation, assessing those controls, supporting the authorizing official's decision, and keeping the authorization alive through continuous monitoring. It sits squarely in the governance, risk and compliance lane rather than the hands-on engineering lane, so it appeals to ISSOs, security control assessors, risk analysts, compliance and audit staff, and program managers who interface with an authorizing official. The CAP1 study guide has 7 sections and about 2,240 words.
01Security and Privacy Governance, Risk Management, and Compliance
Security and privacy governance answers three questions: what must we do (laws, regulations, contracts, mission needs), who is accountable, and how do we know it works. Place NIST SP 800-39's three tiers - organization, mission/business process, information system - and the owners at each.
334 words, about 2 min02Scope of the System
Scoping defines the authorization boundary: the people, processes, technology, facilities, and data the authorization decision covers. Everything inside must be identified - hardware, software, firmware, interfaces, interconnections, and the information types processed, stored, or transmitted.
310 words, about 2 min03Selection and Approval of Security and Privacy Controls
Selection starts with the NIST SP 800-53B baseline for the system's FIPS 199 category, adds the privacy baseline when PII is processed, and then tailors. Tailoring has four recognized moves: scoping (a control genuinely does not apply because of technology or architecture), parameterization (setting organization-defined values), compensating controls (an alternative providing equivalent protection), and supplementation (adding controls beyond the baseline for extra risk).
332 words, about 2 min04Implementation of Security and Privacy Controls
Implementation turns the approved control set into operating reality and records it in the security plan. Each control needs an allocation - system-specific, common/inherited, or hybrid - plus the mechanism used, the responsible role, and where the evidence lives.
294 words, about 1 min05Assessment/Audit of Security and Privacy Controls
Assessment determines whether implemented controls meet their objectives, using NIST SP 800-53A procedures: assessment objectives, methods (examine, interview, test), and objects of assessment. Methods are combined - examine alone rarely proves a control works; examining the policy plus interviewing the operator plus testing a sample is stronger.
320 words, about 2 min06Authorization/Approval of the System
Authorization is the senior official's formal decision that a system may operate with a documented set of controls and an accepted level of residual risk. The decision rests on the authorization package: the security plan, the assessment report, the POA&M, and the risk assessment, often summarized through a continuous monitoring strategy.
319 words, about 2 min07Continuous Monitoring
Continuous monitoring is the ongoing cycle that determines whether controls remain effective after authorization: what to monitor, how often, by whom, and how results reach decision makers. Under NIST SP 800-137 and the final RMF step, an organization builds an information security continuous monitoring program with metrics, sensors, analytics, and reporting.
331 words, about 2 min