ISC2's CAP

CAP Course/Exam Objectives

• Chapter 1: Understanding Security Authorization of Information Systems
  • Understand the Risk Management approach to security authorization
  • Understand and distinguish among the Risk Management Framework (RMF) steps
  • Understand roles and responsibilities of security professionals
  • Understand the security authorization process
  • Understand the relationship between the RMF and SDLC
  • Understand legal, regulatory, and other requirements for Security Authorization
  • Understand common controls and security control inheritance
  • Understand Ongoing Monitoring Strategies
• Chapter 2: Categorize Information Systems
  • Categorize the system
  • Describe the information system, including the security authorization boundaries
  • Register the system
• Chapter 3: Establish Security Control Baseline
  • Identify and document common controls
  • Select and document security controls
  • Develop a security control monitoring strategy
  • Review and Approve a Security Plan
• Chapter 4: Apply Security Controls
  • Implement selected security controls
  • Document security control implementation
• Chapter 5: Assess Security Control
  • Prepare for security control assessment
  • Establish a security control assessment plan
  • Determine security control effectiveness
  • Develop the initial security assessment report
  • Perform initial remediation action
  • Develop the final security assessment report and addendum
• Chapter 6: Authorize Information System
  • Develop Plan of Action and Milestones (POAM)
  • Assemble a security authorization package
  • Determine risks
  • Determine the acceptability of risks
  • Obtain security authorization decisions
• Chapter 7: Monitor Security Controls
  • Determine security impact of changes to systems and environment
  • Perform ongoing security control assessments
  • Conduct ongoing remediation actions
  • Update key documentation
  • Perform periodic security status reporting
  • Perform ongoing risk determination and acceptance
  • Decommission and Remove System

Career Prospects

A CAP certified professional has several career opportunities open up to them, including:

• Authorization Professional
• Accreditation professional
• Chief Security Officer

CAP Exam FAQ's