Description
A self-paced course on the working practice of the Risk Management Framework as it is applied to United States federal and Department of Defense systems. Six modules cover the RMF’s purpose and roles, categorising and scoping a system, selecting and tailoring controls from NIST SP 800-53, implementing and documenting controls in a System Security Plan, assessment and the Plan of Action and Milestones, and earning and sustaining the Authorisation to Operate through continuous monitoring.
Written for information system security officers, security control assessors, engineers and programme staff who are responsible for getting a system authorised and keeping it that way. Tech Skills Library is independent and issues no certification, credential or licence.
What is included
Self-paced online course with 6 modules and 18 lessons, lifetime access to the course content, and a Certificate of Completion badge when every lesson is marked complete.
Curriculum
Module One — RMF Purpose and Authorisation Roles
- Why the RMF Replaced Checklist Accreditation
- Authorising Official and ISSO Responsibilities in Practice
- Reading a DoD Authorisation Package Cold
Module Two — Categorising and Scoping the System
- Drawing the Authorisation Boundary Correctly
- Applying FIPS 199 Impact Levels to Real Data
- Registering the System and Building the Inventory
Module Three — Selecting and Tailoring Controls
- Navigating NIST SP 800-53 Control Families
- Tailoring a Baseline Without Weakening It
- Common Controls and Inheritance from Providers
Module Four — Implementing and Documenting in the SSP
- Writing Control Implementation Statements That Assessors Accept
- Mapping STIG and Scan Results to RMF Controls
- Assembling the Package in eMASS
Module Five — Assessment Findings and the POA&M
- Preparing for a Security Control Assessment
- Reading a Security Assessment Report Critically
- Building a POA&M That Drives Remediation
Module Six — Earning and Sustaining the ATO
- Understanding ATO Decision Types and Conditions
- Designing the Continuous Monitoring Strategy
- Managing Change Without Losing the Authorisation
One-time purchase. Education and skill-building only; completion does not guarantee a job, promotion, security clearance or clearance eligibility, and no certification, credential or licence is issued.
