RMF & ATO: From Categorize to Authorize

Knowing the RMF steps and the eMASS screens is the starting point. This course hands you a system and a deadline.

It is April 2027 at Odapeeka State University, a fictional school in the same universe as GRC I. A fictional DoD program office has just awarded the university a task order to operate the KESTREL Data Exchange (KDX), a cloud-hosted system that collects and serves sensor test data on the Department of Defense’s behalf. That puts KDX under the Risk Management Framework and DoDI 8510.01. You are appointed its Information System Security Officer. Production data starts flowing October 1, and the Authorizing Official has to decide on the truth before then.

What you will produce

Every deliverable adds a section to one KDX Authorization Package:

• 1. An RMF roles and responsibilities matrix and a Prepare-step checklist.
• 2. The system description, authorization boundary, interconnection list and inheritance inventory.
• 3. A security categorization under CNSSI 1253 and a privacy threshold analysis.
• 4. A tailored SP 800-53 control baseline and allocation worksheet, including what KDX inherits from its cloud provider.
• 5. System security plan sections and implementation statements an assessor can test.
• 6. An assessment readiness package: evidence index, STIG and scan triage, and responses to the assessor’s evidence requests.
• 7. A POA&M built from the draft Security Assessment Report, and a risk assessment summary.
• 8. The package front end: executive summary, decision recommendation, draft decision memo and AO briefing outline.
• 9. A continuous monitoring plan and security impact analyses for two proposed changes.

Capstone: the finished, consistent package and your briefing to the Authorizing Official, recorded or written. It is graded against a published rubric with an honesty gate: a package that calls KDX “compliant” with findings still open, or presents an inherited control as your own work, does not pass.

What you walk away with

A complete authorization package for one realistic system, from boundary to signed decision to continuous monitoring. Every organization, system and finding in it is fictional, so it is yours to show in an interview. Never bring a real SSP, eMASS export or scan result into it.

Who it is for

• GRC I graduates continuing the Odapeeka storyline.
• People in, or moving into, ISSO, ISSM support, RMF analyst, package preparation, A&A and compliance roles, especially in DoD and federal contracting.
• Sysadmins and engineers who keep being handed “the STIGs and the SSP”.

Before you start

Complete GRC I (GRC Analyst Prep) or pass the GRC II placement check: a 10-question scenario quiz and one short practical, writing a POA&M entry and an implementation statement from supplied facts. If you place in, you receive the GRC I model Binder so your story starts from the same facts as everyone else’s. Security+ level vocabulary is assumed. There is nothing to install: a spreadsheet, a word processor and judgment.

How it is built

59 lessons in 11 topics. After orientation and RMF foundations, the topics follow the RMF in order, from Prepare through Monitor, and close with the capstone. You complete 9 deliverables, 10 topic quizzes and a 30-question final assessment (130 quiz questions in all), plus the graded capstone. You get AI-assisted feedback on every deliverable, and the AI grader scores your capstone against the published rubric. The course is built by Tyrone E. Wilson, a working vCISO who serves as CISO on a live CMMC Level 2 program. All course material is fictional. None of it comes from client work.

What is included

• CGRC exam prep. The ISC2 CGRC exam outline follows the same path you work in this course: governance, scope, control selection, implementation, assessment, authorization and continuous monitoring. The course maps to all seven CGRC domains and prepares you for the exam, and the included practice exams help you find the gaps. Practice scores are study signals, not predictions of your result.
• The course workbook, templates and the Year Two case packet.
• Model answers for every deliverable after you submit your own.

DoD 8140

Aligned with DoD 8140 work role 722, Information Systems Security Manager, whose tasks DoD notes are shared with Information Systems Security Officers, including ensuring POA&Ms are in place for identified vulnerabilities (T0264). It also practices the authorization-review tasks of work role 612, Security Control Assessor (T0184). Includes CGRC exam prep, a certification DoD 8140 accepts for work roles such as Security Control Assessor (612).

Alignment is not approval. Qualifying for a work role also takes on-the-job qualification and continuing education that your organization tracks.

Level, CPE and certificate

This is GRC II, the second level of the Cover6 GRC & Compliance track. You earn it by completing every lesson, passing the final assessment at 70% or higher, and passing the graded capstone: 80% or higher weighted, no rubric criterion at the lowest score, and the honesty gate passed.

Your certificate is issued in your verified account name and shows the level and 28 CPE hours. CPE hours may be submitted to your certifying body (CompTIA, ISC2, ISACA and others) according to its rules. Each body decides what it accepts.

Next on the track: Security Control Assessor (GRC III), where you move to the assessor’s seat and test a package like the one you built here.

An AO accepts risk only on the strength of what you wrote down. This course is about writing it down honestly.