$397.00 – Purchase this Course

A self-paced course on the working practice of the Risk Management Framework as it is applied to United States federal and Department of Defense systems. Six modules cover the RMF’s purpose and roles, categorising and scoping a system, selecting and tailoring controls from NIST SP 800-53, implementing and documenting controls in a System Security Plan, assessment and the Plan of Action and Milestones, and earning and sustaining the Authorisation to Operate through continuous monitoring.

Written for information system security officers, security control assessors, engineers and programme staff who are responsible for getting a system authorised and keeping it that way. Tech Skills Library is independent and issues no certification, credential or licence.

Modules

Module One — RMF Purpose and Authorisation Roles

Lessons

• Why the RMF Replaced Checklist Accreditation Free Preview
• Authorising Official and ISSO Responsibilities in Practice
• Reading a DoD Authorisation Package Cold

Module Two — Categorising and Scoping the System

Lessons

• Drawing the Authorisation Boundary Correctly
• Applying FIPS 199 Impact Levels to Real Data
• Registering the System and Building the Inventory

Module Three — Selecting and Tailoring Controls

Lessons

• Navigating NIST SP 800-53 Control Families
• Tailoring a Baseline Without Weakening It
• Common Controls and Inheritance from Providers

Module Four — Implementing and Documenting in the SSP

Lessons

• Writing Control Implementation Statements That Assessors Accept
• Mapping STIG and Scan Results to RMF Controls
• Assembling the Package in eMASS

Module Five — Assessment Findings and the POA&M

Lessons

• Preparing for a Security Control Assessment
• Reading a Security Assessment Report Critically
• Building a POA&M That Drives Remediation

Module Six — Earning and Sustaining the ATO

Lessons

• Understanding ATO Decision Types and Conditions
• Designing the Continuous Monitoring Strategy
• Managing Change Without Losing the Authorisation