Zero Trust & Modern Access Certificate Program (Self-Paced)

Self-paced online training with expert support Certificate with 3 courses

Three courses that run the modern access chain end to end: what an identity actually is, how a zero trust architecture gets built and staged, and how federal cloud authorization is changing underneath it.

$2,225 28.5 clock hours Live Support Start anytime

This program includes

  • 28.5 hours of project-based training from experts
  • Answers from real instructors
  • Retake for free within 1 year
  • Access to class recordings (30 days)
  • Verified digital certificate of completion
  • Learn at an accredited institution

This is the self-paced version. For live instruction, enroll in Zero Trust & Modern Access Certificate Program.

This certificate follows the modern access problem from the credential all the way to the authorization boundary. It starts at the identity layer, running the chain in order — identity, proofing, authentication and MFA, authorization, federation, and finally the access decision itself — with particular weight on multifactor authentication, because most federal compromises start with a credential rather than an exploit. Rather than treating multifactor as a single checkbox, it separates the authenticator types, explains the assurance levels behind them, and covers the attacks aimed squarely at MFA, so learners come away able to say why a push notification and a PIV card are not equivalent controls.

From there it becomes architectural and then operational. Zero trust moves from principle to plan: a current-state maturity assessment using the CISA Zero Trust Maturity Model, then the pillars in turn — identity and access modernization, device, network and workload trust enforcement, and application, data and policy enforcement — followed by the visibility, analytics and automation that make zero trust real, and a staged implementation roadmap with governance and metrics attached. The path closes on federal cloud authorization and how it is changing, covering the transition from FedRAMP Rev5 to the 20x model and CR26, so the access architecture is understood alongside the authorization regime it has to satisfy.

Read more

This course has a prerequisite

Basic cybersecurity knowledge, plus basic security and networking familiarity for the zero trust architecture course.

Courses in this Certificate Program

This is the recommended order, but some courses may be taken in a different order.

Download Syllabus PDF

Unit 1 6.5 Hours

ICAM and MFA Fundamentals Course (Self-Paced)

Foundational Identity, Credential, and Access Management for federal staff, covering the chain from identity and proofing through authentication, MFA, authorization, and federation to the access decision.

  • Identity, account, credential, and authenticator, and how authentication, authorization, and access relate
  • Identity proofing and the joiner, mover, leaver lifecycle
  • IAL, AAL, and FAL applied to real access situations
  • Common MFA methods compared by assurance
  • MFA-targeted attacks: phishing, MFA fatigue, credential theft, adversary-in-the-middle
  • Least privilege, need-to-know, RBAC, and ABAC in authorization
  • Federation and single sign-on: identity providers, relying parties, assertions
  • An end-to-end access transaction and access decision

Unit 2 10 Hours

Zero Trust Architecture Implementation (Self-Paced)
  • Explain zero trust principles and the federal drivers behind them
  • Assess current-state maturity using the CISA ZT Maturity Model
  • Modernize identity, credential, and access management
  • Enforce trust across devices, networks, and workloads
  • Architect application, data, and policy enforcement
  • Apply visibility, analytics, and automation for threat response
  • Build a staged zero trust implementation roadmap

Unit 3 2 Days

FedRAMP Modernization: Transitioning from Rev5 to 20x & CR26 (Self-Paced)

Understand what FedRAMP's move to 20x and the Consolidated Rules for 2026 change, and build a transition roadmap. Timed to the January 1, 2027 CR26 deadline.

  • Explain CR26 and the FedRAMP modernization timeline through 2028
  • Contrast Rev5 authorization with 20x certification
  • Describe the new certification classes and boundary changes
  • Modernize packages using Security Decision Records and structured data
  • Apply Key Security Indicators and automated validation
  • Build a Rev5-to-20x transition roadmap
A group of adult learners sits in a classroom, smiling and engaged in a government training session.
A government training instructor in a suit gestures while teaching in front of a whiteboard covered with notes and diagrams.
A person in professional attire holds a Graduate School USA folder, symbolizing participation in government training programs.

Group Training

Since 1921, Graduate School USA has partnered with over 125 federal agencies and trained more than one million federal employees. Led by instructors with deep, real-world knowledge of federal regulations, policies, and practices, our private group programs are practical, mission-driven, and tailored to your agency’s objectives. We offer expertise across key federal domains—including human resources, financial management, acquisition and contracting, leadership, and more—to deliver training where and how your team needs it.

Complete this form and we’ll get back to you within 1 business hour.

The Fact Is – We’ve Been Government’s Training Partner Since 1921

400+ Courses & Certificates 125+ Federal Agencies Served 200+ Subject-Matter Experts