# Security Control Assessor (SCA) Practitioner: The Assessment Lifecycle Canonical URL: ## Overview An authorizing official's decision rests on the independent judgment of the security control assessor. This advanced course develops that craft from one end to the other: establishing authority and independence, setting assessment scope, building a Security Assessment Plan, tailoring NIST SP 800-53A procedures, and carrying out examine, interview, and test methods. Participants weigh evidence across control types, work through common, inherited, and hybrid controls, confirm technical results, and write findings that survive scrutiny. The capstone yields a complete Security Assessment Report. Because the assessor's judgment is the product, the live format gives participants room to argue borderline calls with the instructor and with each other. ## What you'll learn - Explain an SCA's authority, independence, and exercise of professional judgment - Set assessment scope and trace controls back to requirements - Build a Security Assessment Plan and tailor SP 800-53A procedures to it - Put examine, interview, and test methods to work effectively - Weigh whether evidence is sufficient across control families and types - Assess common, inherited, and hybrid controls - Write up findings, determine control effectiveness, and produce a Security Assessment Report ## Curriculum #### Module 1: SCA Authority, Independence, and Professional Judgment - Examine the security control assessor’s mandate, required independence, and responsibility to apply sound professional judgment. #### Module 2: Assessment Scope, System Context, and Control Traceability - Define the assessment scope, establish system context, and trace security controls to applicable requirements. #### Module 3: Developing the Security Assessment Plan - Build a Security Assessment Plan that documents the assessment approach, objectives, procedures, resources, and schedule. #### Module 4: Tailoring Assessment Procedures, Depth, and Coverage - Adapt NIST SP 800-53A assessment procedures, depth, and coverage to the system’s characteristics and risk profile. #### Module 5: Executing Examine, Interview, and Test Procedures - Apply examine, interview, and test methods to collect and validate assessment evidence. #### Module 6: Evaluating Technical, Administrative, and Physical Evidence - Evaluate the relevance, reliability, and sufficiency of technical, administrative, and physical evidence. #### Module 7: Assessing Common, Inherited, and Hybrid Controls - Assess shared control responsibilities across common, inherited, and hybrid control implementations. #### Module 8: Validating Vulnerability and Technical-Test Results - Confirm the accuracy, relevance, and potential impact of vulnerability scan results and other technical findings. #### Module 9: Documenting Findings and Determining Control Effectiveness - Write clear, evidence-based findings and determine whether controls are implemented correctly and operating effectively. #### Module 10: Risk Analysis, Deficiency Prioritization, and POA&M Review - Analyze risk, prioritize identified deficiencies, and review Plans of Action and Milestones for completeness and appropriateness. #### Module 11: Developing the Security Assessment Report Capstone - Produce a complete Security Assessment Report that documents assessment results, findings, risk implications, and supporting evidence. ## Schedule - Jan 7, 2027 – Jan 8, 2027 — Live Online - Feb 8, 2027 – Feb 9, 2027 — Live Online - Mar 8, 2027 – Mar 9, 2027 — Live Online - Apr 26, 2027 – Apr 27, 2027 — Live Online - May 20, 2027 – May 21, 2027 — Live Online - Jun 23, 2027 – Jun 24, 2027 — Live Online - Jul 28, 2027 – Jul 29, 2027 — Live Online ## Instructors ### Wes Bryan — Instructor Wes Bryan resides in Gainesville, Florida, and has built his career around technology, education, and helping others understand complex subjects. He values continuous learning, clear communication, and practical problem-solving. Outside of work, Wesley enjoys running, hiking, fishing, and spending time outdoors. He also has a strong interest in music and literature, enjoys reading both fiction and nonfiction, as well as playing guitar. ### Chuck Moore — Instructor With more than 25 years of experience in IT and cybersecurity, Chuck has built a career on a strong foundation in security, networking, help desk operations, and technical training. He has helped organizations strengthen their security posture by identifying vulnerabilities, conducting threat assessments, implementing security controls, and ensuring compliance with industry standards. Combining extensive technical expertise with a passion for education, Chuck equips professionals with the knowledge and practical skills needed to recognize risks, risks and respond effectively. ## Pricing **Tuition:** $1249