The (ISC)2 Certified Authorization Professional or CAP exam is a viable way to accelerate your career around varied risk management infrastructures. Also, passing such an evaluation will earn you the namesake CAP designation that will prove your understanding of Governance, Risk, and Compliance (GRC).

More about CAP Certification

The renowned CAP designation showcases one’s mastery of information security risk management by proving the authorization of systems in order to back up the legal operations and goals of the company. Notably, this qualification is compliant with ANSI/ISO/IEC standard 17024 and defines a wide scope of topics measured by the CAP Common Body of Knowledge (CBK).

Targeted Audience and Eligibility Requirements

As a rule, the (ISC)2 CAP exam is an ideal fit for information security as well as information assurance specialists who have previously worked with the GRC. Still, the named individuals must have also dealt with implementing and applying programs for risk management within the organization they’ve been working for. Also, eligible candidates must possess 2 years of work experience in at best one CAP CBK domain.

CAP Evaluation Facts

Talking about the nature of the official CAP exam, be ready to solve 125 multiple-choice questions with the allotted time of 3 hours. Besides, to get a pass, you need to score 700 points out of a maximum of 1000 and know that the main test is delivered in English alone. Finally, the registration process for the exam in question is accomplished via Pearson VUE, and you will need to pay as much as $599 for participation in the final CAP evaluation.

Domains to Master for CAP Exam Success

As mentioned above, you have to scrutinize the CAP CBK in order to get acquainted with all its tested topics and related weight. Thus, here’s an outline of the same:

• Program for Information Security Risk Management (16%);
• Information System Scope (11%);
• Shortlisting and Accepting of Privacy & Security Controls (15%);
• Execution of Privacy and Security Controls (16%);
• Audit/Evaluation of Controls for Privacy and Security (16%);
• Information System Authorization or Approval (10%);
• Continual Monitoring (16%).

In particular, the first measured area covers several objectives, where the first one revolves around the foundation of the program for information security risk management. Thus, there, you’ll have to grasp the way of principles for information security, SDLC, frameworks for risk management, and practices alongside controls for security. Then, the succeeding parts of this exam domain talk about the processes of the risk management scheme and define the requirements that are legal and regulatory. So, to have a grip on them, you’ll need to develop skills in controls for management, regulations for privacy, suitable mandates that are security-related, and third-party information systems that are mainly hosted. The second scope denotes the definition of an information system and determines the categorization of the same. In detail, while studying such a topic, you’ll get familiar with the architecture, functions, and purpose of information security and will also check on the types of processed, stored, or transmitted information. Also, here, you’ll get enlightened on the confidentiality, availability, and integrity impact thresholds and will direct the results for documents. The third module underlines the importance of baseline as well as inherited controls that should be identified and documented. Then, the applicants need to learn more about the way to choose and align the controls to a given system by documenting & monitoring applicability and determining the proper usage of enhancements for control. Finally, within this domain, you’ll create a constantly monitoring strategy for control and ratify a security plan for ISMS. The fourth knowledge area, in particular, speaks of two vital objectives. Thus, the first one, implementing the chosen controls, sheds light on obligatory configuration settings, the execution of inherited monitoring as well as providers for control, and the deployment of compensating/alternate controls for security. The second objective explained is jotting down the process of control implementation that looks at documented outputs, deviations, and inputs and getting the facts from suitable entities of an organization like privacy, personnel, and physical security. Then, the fifth chapter expounds on the preparation process for evaluation/audit, how to carry out and collect evidence for the same, and the way to deal with the reports for audit as well as the initial evaluation. What is more, when touching on this topic, you’ll get familiar with the final evaluation process as well as how to develop a plan for remediation by analyzing deficiencies & vulnerabilities. According to the exam syllabus, domain 6 targets to describe the way to compile the authorization for privacy alongside security and how to find out more about the risk for an information system. Lastly, this area finalizes when candidates are able to make an approval of the information system by identifying its corresponding terms. When it comes to the final seventh module, continual monitoring, the applicants will need to demonstrate their understanding of information system setting and how changes can actually influence it. In addition, here, the examinees will have to accomplish continuing evaluations/audits that are compliant with the requirements of a specific company and conduct analysis-controlling activities that belong to supply chain risk. More than these, candidates are to review the strategies for monitoring, know how to update officials about the risk posture necessary for the approval, and perform the decommissioning of the information system.

Career Opportunities

After getting (ISC)2 CAP accredited, specialists are eligible for a range of security-related jobs. Thus, they can opt for several positions including a systems security analyst, cloud security specialist, network security engineer, cybersecurity engineer, and more. What concerns the annual payment that the CAP certified individuals receive, it equals $100k per annum according to the data provided by the Payscale.com website and can vary depending on the job profile you pick.

Certification Path

Having become CAP certified, you can achieve more certificates offered by the (ISC)2. So, the next step to take after the CAP is the Certified Secure Software Lifecycle Professional or CSSLP qualification. Plus, you may want to explore the certification process for the HealthCare Information Security and Privacy Practitioner or HCISPP designation.