Certified Authorization Professional (CAP)

Build Expertise in Security Authorization and Risk Management

The Certified Authorization Professional (CAP) certification by ISC² is a globally recognized credential that validates expertise in risk management frameworks (RMF), security authorization, and continuous monitoring. It is particularly valuable for information security professionals, system administrators, and risk management officers who oversee information systems.

Develop Practical Cybersecurity Skills

This CAP training course from Solomon People Solutions equips professionals with the knowledge and skills needed to assess and authorize information systems effectively. Furthermore, participants will learn how to apply cybersecurity best practices while supporting organizational policies and regulatory requirements.

Strengthen Information System Security

As a result, participants can develop stronger capabilities in risk assessment, security authorization, and continuous monitoring. The training also helps professionals contribute to secure and compliant information system management.

Overview

Practical Skills and Application

Through real-world applications and comprehensive training, this course prepares candidates to manage security risks, design authorization processes, and assess information system controls. Participants will develop the ability to:

Apply RMF Across System Lifecycles – Use the Risk Management Framework (RMF) throughout the information system lifecycle.
Identify Security and Privacy Controls – Identify, assess, and document relevant security and privacy controls.
Conduct Ongoing Assessments – Perform continuous assessment, auditing, and monitoring of information systems.
Prepare for Authority to Operate – Develop the knowledge needed to support the Authority to Operate (ATO) process.

Industry Framework Alignment

Furthermore, the training aligns with recognized industry frameworks and standards, including the National Institute of Standards and Technology (NIST) Risk Management Framework, ISO/IEC 27001, and the Federal Information Security Modernization Act (FISMA).

As a result, participants gain practical knowledge that supports effective security authorization, risk management, and compliance. The program also addresses the requirements associated with ISO/IEC 17024 compliance.

Target Audience

This Certified Authorization Professional (CAP) Training Program is designed for professionals involved in information security, risk management, compliance, and system authorization.

Information System Security Officers (ISSOs) – Professionals responsible for maintaining and overseeing information system security.
Security Analysts and Engineers – Specialists who assess security risks and implement appropriate controls.
System Administrators – IT professionals responsible for managing and securing information systems.
Risk and Compliance Officers – Professionals who manage security risks and ensure regulatory compliance.
Program Managers – Managers responsible for maintaining secure and compliant IT systems.
Auditors and Inspectors General (IGs) – Professionals involved in system reviews, assessments, and security audits.

Pre-Requisites

Pre-Requisites

Candidates must have:

A minimum of 2 years of cumulative, paid, full-time work experience in one or more of the seven domains of the CAP CBK
Relevant experience in security risk management, system authorization, or security control assessment
(ISC)² allows candidates without full experience to become Associates of (ISC)² after passing the exam, with six years to earn the required experience.

Exam info

Exam Information

Exam Code	CAP
Exam Name	ISC2 Certified Authorization Professional
Exam Type	Multiple-choice Questions & Multiple-response Questions
Exam Cost	USD 599
Total Questions	125 Questions
Exam Duration	180 Minutes
Passing Score	700 on a scale of 1000
Languages	English

Course Duration : 5 Days

Course Syllabus

Domain 1: Information Security Risk Management Program

Risk Management and Compliance Foundations

Participants will develop a strong understanding of risk management principles, security frameworks, and regulatory requirements.

Understand Risk Management Frameworks – Explore industry frameworks including NIST, COBIT, ISO/IEC 27001, and ISO 31000.
Define Security Requirements – Establish Software Development Life Cycle (SDLC) requirements and align them with organizational security policies.
Identify Compliance Requirements – Recognize applicable regulatory requirements, including FISMA, FedRAMP, GDPR, and HIPAA.

Furthermore, participants will learn how these frameworks and requirements support effective risk management, security governance, and regulatory compliance.

Domain 2: Scope of the Information System

Information System Categorization

Participants will learn how to categorize information systems and determine the appropriate security requirements based on system characteristics and potential impact.

Define System Boundaries – Identify and document information system boundaries, components, and architecture.
Determine Impact Levels – Assess potential impacts and classify information types according to their security requirements.
Align Security Categorization – Apply relevant privacy and security standards, including FIPS and ISO/IEC 27002.

Furthermore, participants will learn how accurate categorization supports effective risk management, security controls, and compliance.

Domain 3: Selection and Approval of Security and Privacy Controls

Security Control Implementation and Monitoring

Participants will develop the skills needed to implement, tailor, and monitor security controls throughout the information system lifecycle.

Document Security Controls – Identify and document baseline and inherited security controls.
Apply Security Enhancements – Tailor security controls and apply appropriate enhancements based on system requirements and risks.
Develop Monitoring Strategies – Create continuous control monitoring strategies to identify and address security issues.
Review Security Plans – Evaluate and support the approval of security plans and Information Security Management System (ISMS) plans.

Furthermore, participants will learn how effective control implementation and continuous monitoring support stronger security, compliance, and risk management.

Domain 4: Implementation of Security and Privacy Controls

Security Control Implementation and Alignment

Participants will learn how to implement security controls effectively while aligning system configurations with recognized security standards and organizational requirements.

Apply Security Settings – Configure security settings in accordance with ITSG-33, NIST, and Security Technical Implementation Guides (STIGs).
Coordinate Inherited Controls – Work across departments to identify, manage, and document inherited security controls.
Implement Alternative Controls – Apply compensating or alternative controls when standard controls cannot be implemented directly.
Document Control Implementation – Record implementation details and ensure security designs remain aligned with identified risks.

Furthermore, participants will learn how consistent control implementation strengthens security, supports compliance, and maintains a risk-based approach to system protection.

Domain 5: Assessment/Audit of Security and Privacy Controls

Security Assessment and Audit

Participants will develop the skills needed to plan, conduct, and document effective security assessments and audits.

Prepare Audit Activities – Define the audit scope and collect relevant documentation and evidence.
Conduct Security Assessments – Perform assessments using approved tools, procedures, and methodologies.
Manage Remediation – Recommend corrective actions, conduct reassessments, and document progress.
Finalize Audit Reports – Prepare final audit reports and develop appropriate remediation plans.

Furthermore, participants will learn how structured assessments and timely remediation can strengthen security controls and support ongoing compliance.

Domain 6: Authorization/Approval of Information System

System Authorization and Risk Acceptance

Participants will learn how to prepare systems for formal authorization while evaluating risks and supporting informed authorization decisions.

Prepare Authorization Documentation – Compile the required documentation and evidence for system authorization.
Evaluate System Risk – Assess system risks and evaluate available residual risk options.
Support Authorization Decisions – Approve systems within defined risk tolerances and Authority to Operate (ATO) requirements.

Furthermore, participants will learn how risk-based authorization decisions support secure and compliant information system operations.

Domain 7: Continuous Monitoring

Continuous Monitoring and System Lifecycle Management

Participants will learn how to maintain security throughout the system lifecycle by monitoring changes, vulnerabilities, threats, and emerging risks.

Monitor System Changes and Threats – Identify changes and emerging threats that may affect system security.
Conduct Ongoing Assessments – Perform continuous assessments and vulnerability scanning to identify security weaknesses.
Monitor Emerging Risks – Track supply chain risks, legal and regulatory updates, and relevant threat intelligence.
Support Response Planning – Participate in response planning and maintain an accurate system security posture.
Manage Secure Decommissioning – Apply appropriate security practices when systems reach the end of their lifecycle.

Benefits
Schedule & Fee

Benefits

Master Risk Management – Build a comprehensive understanding of RMF and security authorization processes.
Career Advancement – Qualify for roles in cybersecurity governance, compliance, and system auditing.
Improved Earning Potential – CAP-certified professionals are in demand in defense, government, and private sectors.
Boost Organizational Security – Learn to implement and monitor robust cybersecurity controls.
Demonstrate Compliance – Ensure your organization aligns with frameworks like NIST, ISO/IEC 27001, and FISMA.

Schedule & Fee

Upcoming Schedules: Please contact us to know more about our next available CAP training sessions and pricing.

Elevate your career in risk management and information system security with CAP certification.