CAP CBK Domains

In order to pass the CAP exam, the candidate must have a thorough understanding of the CAP CBK domains and be familiar with National Institute of Standards and Technology (NIST) documentation.

The successful CAP candidate will earn the distinction of being among the few who have demonstrated their exceptional knowledge in this demanding and rewarding field. Organizations will benefit from having a staff that is fully educated and certified to the same level as the auditors and inspectors that will be evaluating them. Along with proper management support, this highly trained and certified staff member will be able to improve the security posture of any organization.   

Employees with the CAP credential distinguish themselves as certified professionals in this elite field creating job opportunities. Organizations win by improving their security posture with risk-based, cost-effective security maintained by highly trained personnel.  

The CAP examination domains and weights are:



1. Risk Management Framework (RMF)


2. Categorization of Information Systems


3. Selection of Security Controls


4. Security Control Implementation


5. Security Control Assessment


6. Information System Authorization


7. Monitoring of Security Controls




1.  Risk Management Framework (RMF)

Security authorization includes a tiered risk management approach to evaluate both strategic and tactical risk across the enterprise. The authorization process incorporates the application of a Risk Management Framework (RMF), a review of the organizational structure, and the business process/mission as the foundation for the implementation and assessment of specified security controls. This authorization management process identifies vulnerabilities and security controls and determines residual risks. The residual risks are evaluated and deemed either acceptable or unacceptable. More controls must be implemented to reduce unacceptable risk. The system may be deployed only when the residual risks are acceptable to the enterprise and a satisfactory security plan is complete.

2.  Categorization of Information Systems

Categorization of the information system is based on an impact analysis. It is performed to determine the types of information included within the security authorization boundary, the security requirements for the information types, and the potential impact on the organization resulting from a security compromise. The result of the categorization is used as the basis for developing the security plan, selecting security controls, and determining the risk inherent in operating the system.

3.  Selection of Security Controls

The security control baseline is established by determining specific controls required to protect the system based on the security categorization of the system. The baseline is tailored and supplemented in accordance with an organizational assessment of risk and local parameters. The security control baseline, as well as the plan for monitoring it, is documented in the security plan.

4.  Security Control Implementation

The security controls specified in the security plan are implemented by taking into account the minimum organizational assurance requirements. The security plan describes how the controls are employed within the information system and its operational environment. The security assessment plan documents the methods for testing these controls and the expected results throughout the systems life-cycle.

5.  Security Control Assessment

The security control assessment follows the approved plan, including defined procedures, to determine the effectiveness of the controls in meeting security requirements of the information system. The results are documented in the Security Assessment Report.

6.  Information System Authorization 

The residual risks identified during the security control assessment are evaluated and the decision is made to authorize the system to operate, deny its operation, or remediate the deficiencies. Associated documentation is prepared and/or updated depending on the authorization decision.

7.  Monitoring of Security Controls

After an Authorization to Operate (ATO) is granted, ongoing continuous monitoring is performed on all identified security controls as well as the political, legal, and physical environment in which the system operates. Changes to the system or its operational environment are documented and analyzed. The security state of the system is reported to designated responsible officials. Significant changes will cause the system to reenter the security authorization process. Otherwise, the system will continue to be monitored on an ongoing basis in accordance with the organization’s monitoring strategy.

Logo CAP
certs chart top