Federal RMF Practitioner Certificate Program (Self-Paced)
IDCYSE.CP.L1.SP

Foundational to Intermediate Self-Paced Online 3 Courses 28 Hours ~2.8 CEUs

Everything you need to take a federal system through the full Risk Management Framework, from categorization to an authorization to operate.

$2,249 28 clock hours Live Support Start anytime

This program includes

  • 28 hours of project-based training from experts
  • Answers from real instructors
  • Retake for free within 1 year
  • Access to class recordings (30 days)
  • Verified digital certificate of completion
  • Learn at an accredited institution
  • Credits: 2.8 CEUs

The Risk Management Framework is the backbone of how federal information systems are secured and authorized. This program takes a practitioner from the core RMF lifecycle through hands-on control selection and into the continuous monitoring that keeps a system authorized over time. It aligns to NIST SP 800-37, SP 800-53 Rev 5, SP 800-53B, and SP 800-137, and to the NICE work roles for Information System Security Officer and Manager.

Prepares you for: the ISSO/ISSM role and foundational preparation toward the ISC2 CGRC (Certified in Governance, Risk and Compliance).

Read more

Courses in this Certificate Program

This is the recommended order, but some courses may be taken in a different order.

Download Syllabus PDF

Unit 1 8 Hours

RMF Foundations: From Risk to Authorization (Self-Paced) (Coming Soon)
  • Explain the purpose of the NIST RMF and how it links risk to authorization
  • Identify the key RMF roles and their responsibilities
  • Categorize a system's impact level using FIPS 199
  • Select and tailor a control baseline using NIST SP 800-53B
  • Describe how controls are implemented, assessed, and documented
  • Interpret an authorization decision and residual-risk acceptance
  • Explain continuous monitoring's role in maintaining an authorization

Unit 2 12 Hours

NIST 800-53: Control Selection, Implementation, and Security Planning Course (Self-Paced)

This course equips federal security practitioners with the skills to select, tailor, and document NIST SP 800-53 Rev 5 controls for federal information systems. Participants build implementation statements across the highest-impact control families, prepare assessment-ready evidence, and develop compliant POA&M entries grounded in 800-53A assessment procedures.

  • Baseline selection and tailoring from NIST SP 800-53B, including scoping guidance, compensating controls, and organization-defined parameters.
  • SSP implementation statements for the AC, IA, AU, CM, IR, and SC control families meeting 800-53A evidence sufficiency standards.
  • Privacy controls and Supply Chain Risk Management (SR) family requirements for applicable federal systems.
  • Assessment readiness using 800-53A procedures, including evidence collection standards and finding severity classification.
  • POA&M development with milestone tracking, resource estimates, and FISMA reporting linkage.

Unit 3 8 Hours

FISMA & Continuous Monitoring Fundamentals (Self-Paced) (Coming Soon)

An authorization to operate isn't the finish line—federal systems must be monitored continuously, with weaknesses tracked and risk reported to leadership over time. This intermediate course grounds Information Security Continuous Monitoring (NIST SP 800-137) in FISMA accountability: you'll design an ISCM strategy, manage findings through POA&Ms, and build the metrics and reporting that support ongoing authorization.

  • Explain FISMA accountability and oversight structures
  • Design an ISCM strategy aligned to NIST SP 800-137
  • Establish asset, configuration, and vulnerability visibility
  • Manage ongoing control assessment and evidence
  • Build security metrics and risk reporting for leadership
  • Manage findings and POA&Ms with a risk-based approach
  • Describe ongoing authorization and how to evaluate an ISCM program
A group of adult learners sits in a classroom, smiling and engaged in a government training session.
A government training instructor in a suit gestures while teaching in front of a whiteboard covered with notes and diagrams.
A person in professional attire holds a Graduate School USA folder, symbolizing participation in government training programs.

Related Courses: Compare to the Federal RMF Practitioner Certificate Program (Self-Paced)

These related courses share skills and topics with the Federal RMF Practitioner Certificate Program (Self-Paced). Select up to two and tap Compare selected courses to view a side-by-side comparison.

Group Training

Since 1921, Graduate School USA has partnered with over 125 federal agencies and trained more than one million federal employees. Led by instructors with deep, real-world knowledge of federal regulations, policies, and practices, our private group programs are practical, mission-driven, and tailored to your agency’s objectives. We offer expertise across key federal domains—including human resources, financial management, acquisition and contracting, leadership, and more—to deliver training where and how your team needs it.

Complete this form and we’ll get back to you within 1 business hour.

The Fact Is – We’ve Been Government’s Training Partner Since 1921

400+ Courses & Certificates 125+ Federal Agencies Served 200+ Subject-Matter Experts