topic Re: Don't be afraid of Government Regulations! Take the CAP! in Exam Preparation

Don't be afraid of Government Regulations! Take the CAP!

Stpn2me — Thu, 12 Oct 2017 14:22:34 GMT

Hello everyone! I just took and passed the Certified Authorization Professional exam. Leaning about how the Reference Managment Framework aligns with the Systems Development LifeCycle was a hoot! It's a good exam to take and one that's going to be really sought after as large companies and the Federal Govt decide how important it is to have security controls on your network. As me any question here and I will try to help!

Pat Hairston

CISSP, CAP

Re: Don't be afraid of Government Regulations! Take the CAP!

jrisner1 — Thu, 12 Oct 2017 15:16:39 GMT

Can you elaborate a bit more on the exam? I am curious about it.

Re: Don't be afraid of Government Regulations! Take the CAP!

Stpn2me — Thu, 12 Oct 2017 15:23:53 GMT

The exam consists almost entirely of the Reference Management Framework and the resulting NIST control standards and how to implement them. Mostly the Federal Government uses these standards, but I'm finding alot of large companies are starting to see the value of securing their networks using these standards..

Re: Don't be afraid of Government Regulations! Take the CAP!

Cobra302pwr — Tue, 07 Nov 2017 16:44:32 GMT

Hello Pat,

First I would like to say congrats to ya on passing the exam. I was wondering if you could tell me what are some good training materials or classes I could attend and acquire to better prepare me for this exam?

V/R

Alphonso Price

Re: Don't be afraid of Government Regulations! Take the CAP!

Stpn2me — Wed, 08 Nov 2017 12:56:18 GMT

I took the online class from ISC2. The Body of Knowledge is the best thing that helped me get ready for the class. The book ISC2 gives you is set up nicely. That's all I used. Plus, having an overall knowledge of NIST and the network approval process helps!

Let me know if you have anymore questions...

Re: Don't be afraid of Government Regulations! Take the CAP!

Cobra302pwr — Wed, 08 Nov 2017 13:03:16 GMT

Thank you very much!! Your advice is very much appreciated, thank you Sir.

I sure will, have a good one.

Re: Don't be afraid of Government Regulations! Take the CAP!

kenisia_wilson — Mon, 08 Jan 2018 16:36:35 GMT

Re: Don't be afraid of Government Regulations! Take the CAP!

kenisia_wilson — Mon, 08 Jan 2018 16:38:16 GMT

Hi Pat,

I am scheduled to take the CAP exam this year. Can you provide any references or resources that helped you to prepare the most for the exam?

Re: Don't be afraid of Government Regulations! Take the CAP!

kenisia_wilson — Mon, 08 Jan 2018 16:43:17 GMT

Just noticed your reply to others on this topic. I appreciate your input. Thanks and congrats to you!

Re: Don't be afraid of Government Regulations! Take the CAP!

Stpn2me — Mon, 08 Jan 2018 17:26:11 GMT

I'll also add understand the Systems Development Life Cycle and how it mirrors the RMF framework. Once I learned that, the test was a piece of cake, I swear. It was alot easier than the CISSP...

Pat

Re: Don't be afraid of Government Regulations! Take the CAP!

Faddakings — Sun, 25 Feb 2018 17:20:29 GMT

I’m studying now for the CAP. I basically printed the over 100+ plus pages of the NIST SP 800 37 and that all I’m using. It that enough?

Re: Don't be afraid of Government Regulations! Take the CAP!

lolybum — Sun, 25 Feb 2018 23:01:22 GMT

Congratulations, please can you share some past questions?

Re: Don't be afraid of Government Regulations! Take the CAP!

ssquires_mn — Wed, 23 May 2018 16:36:19 GMT

If your a Federal Government employee there is a CAP course out on https://fedvte.usalearning.gov you can take. It has a 50 question test at the end. The CAP CBK if I remember right has about 40 sample questions.

I took the CAP test yesterday and was trying to figure out how ISC2 was going to come up with 125 questions since the CAP CBK domains are covered in less than 300 pages. I have to say I enjoy the ISC2 tests at least the traditional tests (haven't had the pleasure of taking one of their adaptive tests yet) and think they do a great job of assessing knowledge. I'd like to see the CAP test become a requirement for all federal government ISSOs.

Re: Don't be afraid of Government Regulations! Take the CAP!

garrettds11 — Thu, 16 Aug 2018 02:11:07 GMT

Hi Pat,

You mentioned the Reference Mgmt Framework, and I have never heard of that. I thought the CAP was about applying RMF, the Risk Mgmt Framework. I am evaluating my interest in the CAP exam, and looking for study materials. Can you help?

Re: Don't be afraid of Government Regulations! Take the CAP!

Faddakings — Thu, 16 Aug 2018 03:11:50 GMT

There isn’t a lot of materials on CAP out there. NIST SP 800-37r1 Is the most all inclusive document for the CAP exams. You can supplement it with other NIST publications like FIPS 199,200: SP 800-60,-18,-53,-53A, -137. Good luck!!

Re: Don't be afraid of Government Regulations! Take the CAP!

CraginS — Thu, 16 Aug 2018 12:41:06 GMT

@Stpn2me wrote:
Leaning about how the Reference Managment Framework aligns with the Systems Development LifeCycle was a hoot!

I believe you mean the Risk Management Framework, as described in NIST Special Publications (SP) 800-30, 800-37, 800-53, 800-53A, etc.

A bit of (ISC)2 history: The CAP certification and exam grew out of a request from the U.S. State Department that (ISC)2 develop an exam to be sure information security specialists taking part in the certification & accreditation (C&A) of departmental information systems knew what they were doing. The C&A process was required by provisions in the Federal Information Systems Management Act of 2002 (FISMA).

While at one time there were various C&A processes in use across the U.S. government, a multi-agency Task Force led by NIST consolidated the process into the Risk Management Framework as we see it today. It has taken many years for each department or agency to convert to the RMF in accordance with the SPs listed above, but that work is moving forward. The process has also changed in response to the Federal Information Systems Modernization Act (FISMA II) of 2014.

Of special note, what had been the C&A process prior to the RMF is replaced by the assessment and authorization (A&A) process. A significant part of the shift from C&A to A&A is the expected shift from a compliance review and enforcement approach to a risk assessment and management approach. How well that change in philosophy from compliance to management is working is still up for grabs.

As a side comment, I was told several years ago that all knowledge required to pass the CAP exam is also an integral part of the RMF knowledge essential to passing he CISSP-ISSEP concentration exam. While I have not confirmed it personally, the advice was to take the CAP exam right after passing the CISSP-ISSEP exam.

Re: Don't be afraid of Government Regulations! Take the CAP!

Cobra302pwr — Tue, 21 Aug 2018 14:32:59 GMT

Excellent suggestion, thank you!

Re: Don't be afraid of Government Regulations! Take the CAP!

crystal_waston — Thu, 04 Oct 2018 07:20:09 GMT

The Certified Authorization Professional (CAP) is an information security practitioner who champions system security commensurate with an organization's mission and risk tolerance, while meeting legal and regulatory requirements.