CAP1 study plan
CAP1 · Give each week a clear focus.
8 weeks · About 7 hours per week
Assessment/Audit of Security and Privacy Controls
Differentiate the three assessment methods (interview, examine, test) and select the correct method for a stated control objective
Map assessment evidence expectations to a sample artifact list for at least ten control families
Explain how assessment findings become risk-rated POA&M entries with owners and milestones
Build and answer a 25-question self-quiz on assessment scoping, sampling, and evidence sufficiency
Your checkpoint
One-page assessment methodology cheat sheet plus a logged 25-question quiz with score and missed-item notes
Assessment/Audit of Security and Privacy Controls & Security and Privacy Governance, Risk Management, and Compliance
Trace the full RMF sequence from memory and state the inputs and outputs of each step
Contrast governance roles (authorizing official, system owner, ISSO, privacy officer) by decision rights and accountability
Write ten original scenario questions on assessment findings and grade them against source text
Distinguish independent assessment from self-assessment and identify when each is acceptable
Your checkpoint
RMF step-by-step input/output table paired with a role-to-responsibility matrix covering six roles
Security and Privacy Governance, Risk Management, and Compliance
Classify fifteen sample policy statements as governance, risk management, or compliance obligations
Score eight risk scenarios using a qualitative likelihood-by-impact matrix and justify each rating
Separate privacy obligations (PII handling, consent, retention, notice) from security obligations across ten cases
Summarize the three risk management tiers (organization, mission/business process, system) and their interactions
Your checkpoint
Ten-entry risk register with scored likelihood, impact, overall rating, and proposed treatment for each entry
Continuous Monitoring
Assign monitoring frequency and metrics to each control family based on volatility and impact
Define the components of a continuous monitoring strategy including configuration management, status reporting, and ongoing authorization
Interpret a described control-status scorecard and identify which metrics would trigger escalation
Explain how monitoring results feed back into authorization decisions and POA&M updates
Your checkpoint
Continuous monitoring plan outline with a monitoring frequency table and a timed 40-question mixed quiz on Domains 5, 1, and 7
Implementation of Security and Privacy Controls
Sequence control implementation activities from selection through deployment for ten controls
Identify common control inheritance and shared-service boundaries in a described organization
Draft implementation statements that describe how a control is satisfied without restating control text
List the documentation and artifacts needed to evidence control implementation
Your checkpoint
Implementation package for eight controls, each with an implementation statement and an evidence artifact list
Authorization/Approval of the System & Security and Privacy Governance, Risk Management, and Compliance
Assemble an authorization package checklist (SSP, assessment results, POA&M, risk determination) and note who signs each item
Distinguish authorization outcomes including authorization to operate, denial, and interim authorization
Write a risk acceptance justification from a supplied set of residual risks
Explain how continuous monitoring feeds ongoing authorization decisions
Your checkpoint
Mock authorization decision memo with written justification plus a 20-question Domain 6 quiz
Selection and Approval of Security and Privacy Controls & Scope of the System
Apply baseline selection and tailoring (scoping, compensating controls, parameter setting) to three system types
Define system boundaries for three scenarios and list inherited and common controls for each
Assign confidentiality, integrity, and availability impact levels for two scenarios and justify each level
Explain how control selection depends on system categorization and organizational risk tolerance
Your checkpoint
Tailored control baseline for one scenario with a text-described boundary, inherited control list, and categorization rationale
Assessment/Audit of Security and Privacy Controls & Security and Privacy Governance, Risk Management, and Compliance & Continuous Monitoring & Implementation of Security and Privacy Controls & Authorization/Approval of the System & Selection and Approval of Security and Privacy Controls & Scope of the System
Re-drill every missed item from weeks 1 through 7 and restate each correction in one sentence
Complete two full-length timed practice exams under exam conditions
Rank all seven domains by practice score and re-study the two weakest
Recite the RMF steps, key role definitions, and authorization package contents from memory
Your checkpoint
Full-length practice exam scored at or above 80 percent, with a complete error log and a one-page recall sheet covering all seven domains
Milestones
Week 4: Score at least 75 percent on the timed 40-question quiz covering Domains 5, 1, and 7, and log every missed item with its root cause
Week 6: Authorization decision memo passes a self-applied rubric (clear risk determination, cited evidence, named decision authority) and Domain 6 quiz scores at least 80 percent
Week 8: Complete two full-length timed practice exams at or above 80 percent with no domain scoring below 70 percent