# RMF Foundations: From Risk to Authorization Canonical URL: ## Overview Every federal information system that reaches production gets there through the NIST Risk Management Framework. This foundational course follows that framework end to end as NIST SP 800-37 defines it, tying each stage back to the risk decision it exists to inform. Beginning with the fundamentals of risk and governance, participants work through all seven RMF steps — Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor — and close with an integrated capstone that traces a single system across the whole sequence. No prior authorization experience is assumed; the class exists to establish the shared vocabulary and mental model that the rest of the RMF track builds on. Sessions run live with an instructor, so questions can be raised as each step is introduced. ## What you'll learn - Describe what the NIST RMF is for and how it ties risk to an authorization decision - Recognize the principal RMF roles and what each one is accountable for - Set a system's impact level using FIPS 199 - Choose and tailor a control baseline against NIST SP 800-53B - Trace how controls are implemented, assessed, and documented - Read an authorization decision and the residual risk it accepts - Account for the part continuous monitoring plays in keeping an authorization current ## Curriculum #### Module 1: RMF Orientation and Risk Fundamentals - Explore why the Risk Management Framework exists and how it connects cybersecurity activities to organizational missions. #### Module 2: RMF Governance, Risk Levels, and Participant Roles - Examine the three risk tiers and the roles and responsibilities that support the RMF process. #### Module 3: Prepare - Review organization- and system-level activities that establish readiness for the RMF process. #### Module 4: Categorize - Determine system impact levels using Federal Information Processing Standard 199. #### Module 5: Select - Apply control baselines and tailoring guidance using NIST Special Publication 800-53B. #### Module 6: Implement - Put selected security controls in place and document how they have been implemented. #### Module 7: Assess - Produce and evaluate evidence to determine whether security controls are implemented correctly and operating effectively. #### Module 8: Authorize - Evaluate residual risk and support the issuance of an authorization decision. #### Module 9: Monitor - Maintain current information about control effectiveness, system changes, and organizational risk. #### Module 10: Integrated RMF Capstone and Knowledge Check - Apply the complete RMF process through an integrated capstone exercise and knowledge check. ## Schedule - Oct 20, 2026 9:00am–4:30pm — Live Online - Jan 21, 2027 9:00am–4:30pm — Live Online - Feb 19, 2027 9:00am–4:30pm — Live Online - Mar 31, 2027 9:00am–4:30pm — Live Online - Apr 14, 2027 9:00am–4:30pm — Live Online - May 7, 2027 9:00am–4:30pm — Live Online - Jun 17, 2027 9:00am–4:30pm — Live Online - Jul 14, 2027 9:00am–4:30pm — Live Online ## Instructors ### Wes Bryan — Instructor Wes Bryan resides in Gainesville, Florida, and has built his career around technology, education, and helping others understand complex subjects. He values continuous learning, clear communication, and practical problem-solving. Outside of work, Wesley enjoys running, hiking, fishing, and spending time outdoors. He also has a strong interest in music and literature, enjoys reading both fiction and nonfiction, as well as playing guitar. ### Chuck Moore — Instructor With more than 25 years of experience in IT and cybersecurity, Chuck has built a career on a strong foundation in security, networking, help desk operations, and technical training. He has helped organizations strengthen their security posture by identifying vulnerabilities, conducting threat assessments, implementing security controls, and ensuring compliance with industry standards. Combining extensive technical expertise with a passion for education, Chuck equips professionals with the knowledge and practical skills needed to recognize risks, risks and respond effectively. ## Pricing **Tuition:** $799