Our cybersecurity curriculum helps federal employees and working professionals stay ahead of evolving threats.
Build the RMF core first, then specialize in authorizing and sustaining secure federal cloud services.
Build the RMF core first, then specialize as the independent assessor an authorizing official leans on.
Assess, authorize, and sustain secure federal cloud services — and stay ahead of FedRAMP's move to the 20x model.
Grow into the independent assessor an authorizing official can lean on — from assessment plan through to a Security Assessment Report that holds up.
A four-course federal GRC path: risk assessment and quantification, cybersecurity supply chain risk management, security and privacy program management, and CMMC 2.0 readiness.
Build the complete federal security operations skill set, starting with how a federal SOC actually works, moving into responding when something is found, and finishing with proactively hunting threats before an alert ever fires. Aligned to NIST and CSF 2.0 standards, it prepares you for Federal SOC Analyst, Detection Engineer, and threat hunter roles and toward the CompTIA CySA+, GIAC GCIH, and GMON credentials.
Master the full federal incident investigation lifecycle, from response and containment through forensics and malware analysis, in one comprehensive credential. Aligned to NIST and CISA standards, it prepares you for incident responder, forensic examiner, and SOC roles and toward the GIAC GCIH and GCFE certifications.
A three-course engineering path through AI security: securing AI/ML systems, monitoring and incident response, then red teaming and assurance.
A three-course live path through identity and phishing-resistant MFA, zero trust architecture implementation, and the FedRAMP transition from Rev5 to 20x and CR26.
All of what it takes to carry a federal system through the Risk Management Framework, from categorization to an authorization to operate.
Secure and govern AI inside a federal environment — from the threat landscape through to a working agency AI security and governance program.
A two-course live path through federal cloud security: fundamentals and FedRAMP context, then architecture and hardening taught against real recent cloud breaches.
Learn how federal information must be protected, marked, and kept — from PII and PHI under the Privacy Act, to recognizing and handling CUI, to federal records retention and disposition.
Receive instruction from subject‑matter experts who bring proven government experience.
Courses that are regularly updated based on feedback and industry developments, ensuring versions are mapped to federal competencies.
The instructor was wonderful and so knowledgeable. The course materials were extremely relevant to what my job is. I feel like I can be better because of this class.
— 2025 student
Directly addressing the day-to-day challenges of federal employees.
Your trusted training partner, equipping public service professionals with the skills and knowledge to excel in their roles and drive meaningful impact.
Prepare for the CISSP certification exam with comprehensive coverage of the 8 domains of information security, from risk management to network security and cryptography. Ideal for IT security professionals seeking career advancement or certification.
Take FedRAMP package due diligence to depth, hold CSPs to account on continuous monitoring obligations, and design enterprise governance for multi-cloud federal portfolios.
Run advanced 800-53A assessments, write control overlays for cloud, OT, and AI/ML systems, and build the enterprise governance to manage a federal controls program.
Federal agencies are putting AI into service faster than the practices meant to govern and secure it. This intermediate course helps federal staff and their partners build an agency AI governance and security program rooted in federal AI policy and the NIST AI Risk Management Framework — covering AI inventories and risk classification, data governance and privacy, the AI development and acquisition lifecycle, machine learning and generative AI threats, and the oversight and monitoring that keep AI trustworthy, ending with a capstone plan you build yourself.
An authorizing official's decision rests on the independent judgment of the security control assessor. This advanced course develops that craft end to end — establishing independence, setting scope, tailoring NIST SP 800-53A procedures, and carrying out examine, interview, and test methods — so findings survive scrutiny, culminating in a complete Security Assessment Report.
Prepare to operate effectively inside a federal Security Operations Center, whether you are new to SOC work or an analyst who wants to firm up the federal standards and terminology behind the job. Unlike generic SOC training, every operational topic — log collection, continuous monitoring, detection engineering, and incident response — is grounded in the statutes, policy memoranda, and technical standards that actually govern federal cyber defense.
Twelve hours live on AI red teaming and assurance: running an engagement, matching technique to attack surface, building an auditable assurance case, and testing agentic systems. No lab needed.
A full pass through governance, risk and compliance — including FAIR quantification and an applied SEC materiality determination — for the person who has to turn technical findings into a defensible risk decision.
Two days live on cybersecurity supply chain risk management, built on NIST SP 800-161r1 and current to August 2026 on federal policy — criticality, supplier due diligence, acquisition, software supply chain, and monitoring.
Conduct defensible digital forensics and incident investigations using the NIST SP 800-86 forensic process — Collection, Examination, Analysis, and Reporting. Work through IOC investigation, chain of custody, and the federal legal and oversight framework, then bring it together in a full capstone investigation.
Run a federal incident response program end to end, organized the way NIST now organizes it: from governance and readiness, through detection and the one-hour CISA notification clock, to recovery and continuous improvement.
Assess FedRAMP-authorized cloud services, drive the agency ATO process, and hold shared security responsibilities together across the service lifecycle.
Get clear on what FedRAMP's shift to 20x and the Consolidated Rules for 2026 actually change, and leave with a transition roadmap. Timed to the January 1, 2027 CR26 deadline.
Work through both static analysis (examining files without running them) and dynamic analysis (interpreting behavior from sandbox and monitoring reports), and build the judgment to know which technique fits each situation. Following NIST SP 800-83 Rev. 1, the course brings in the tools analysts rely on — disassemblers, sandboxes, YARA, network capture, and CISA's Malware Next-Gen — with a federal thread on sample sensitivity and data handling throughout.
Select, document, and assess the security and privacy controls that federal information systems are measured against.
Twelve hours on securing AI and ML systems as systems — adversarial machine learning, prompt injection, model integrity, and the AI supply chain — closing with a threat-modeling workshop.
Twelve hours live on running security and privacy as one program — governance, strategy, risk, controls, assurance, and a defended leadership briefing.
Take the threat hunting and detection engineering skills you already have and build them into a defensible program, using a methodology sourced entirely from NIST, CISA, and DoD publications. Covers a repeatable hunt process, bias-reducing analytic techniques, the full detection lifecycle, and the validation and metrics that prove risk is going down.
Two days live on cloud security architecture and operations, anchored to real recent breaches including the 2024 Snowflake tenant compromise and Storm-0558.
Ten hours on federal web application security for technical and oversight staff alike — the policy landscape, the OWASP Top 10, secure development, access control, and monitoring. No lab required.
Take zero trust from principle to plan: assess current-state maturity, work the pillars, and leave with a staged implementation roadmap backed by governance and metrics.
Eight hours live on AI security monitoring and incident response — the four monitoring categories, a signals table mapping what you see to what it means, and containment actions specific to AI systems.
An ATO is a beginning, not an ending — federal systems must be watched continuously, with weaknesses tracked and risk reported to leadership over time. This intermediate course grounds Information Security Continuous Monitoring (NIST SP 800-137) in FISMA accountability: design an ISCM strategy, work findings through POA&Ms, and build the metrics and reporting that make ongoing authorization possible.
Work through every stage of the NIST Risk Management Framework, from setting a system's impact level to signing off on its authorization to operate.
A full day live on the identity layer: identity, proofing, authentication and MFA, authorization, federation, and the access decision itself — with phishing-resistant MFA at the center.
Most organizations now use AI rather than build it, so every security professional has to treat AI as part of the attack surface. This foundational course — no AI/ML background needed — covers the AI threat landscape (MITRE ATLAS), the risks of LLM apps (OWASP Top 10 for LLM Applications), and the dangers of AI agents, tying it to the NIST AI Risk Management Framework and the everyday defenses that keep AI systems secure.
A jargon-free grounding in how federal cloud services get secured and where one party's responsibility ends and the other's begins.
Six hours live on federal recordkeeping — records versus non-records, the lifecycle, retention and disposition schedules, litigation holds, and records created in email, chat and collaboration tools.
A half day live on the full CUI lifecycle — recognizing it, marking it, handling it, and reporting incidents — including the new federal guidance on using CUI with AI tools.
A half-day live session on insider threat: what the indicators really look like, where to report them, and how insider threat reporting differs from a protected whistleblower disclosure.
A half day live on mobile and telework security written for the device user, not the administrator — phishing-resistant authentication, MFA abuse, home networks, and what to do when something goes wrong.
A half-day live session on federal privacy: what the Privacy Act requires, how to tell PII from sensitive PII from PHI, and the first hour after a suspected breach.
A half day live on federal ethics: the 14 General Principles, conflicts of interest, gifts, misuse of position, post-government employment, and the Hatch Act — updated for the 2024 modernization.
A plain-language overview of CMMC 2.0 for federal contractors - what it is, who must comply, the maturity levels, and the rollout timeline you need to plan around.
Master the RMF core, then specialize in authorizing and maintaining secure federal cloud services.
Master the RMF core, then specialize as the independent assessor an authorizing official relies on.
Evaluate, authorize, and maintain secure federal cloud services — and get ahead of FedRAMP's move to the 20x model.
Become the independent assessor an authorizing official can rely on — from assessment plan to a defensible Security Assessment Report.
Work through federal GRC at your own pace: risk assessment and quantification, supply chain risk management, security and privacy program management, and CMMC 2.0 readiness.
Build the complete federal security operations skill set, starting with how a federal SOC actually works, moving into responding when something is found, and finishing with proactively hunting threats before an alert ever fires. Aligned to NIST and CSF 2.0 standards, it prepares you for Federal SOC Analyst, Detection Engineer, and threat hunter roles and toward the CompTIA CySA+, GIAC GCIH, and GMON credentials.
Master the full federal incident investigation lifecycle, from response and containment through forensics and malware analysis, in one comprehensive credential. Aligned to NIST and CISA standards, it prepares you for incident responder, forensic examiner, and SOC roles and toward the GIAC GCIH and GCFE certifications.
A three-course self-paced engineering path: securing AI/ML systems, monitoring and responding to AI incidents, then red teaming and assurance.
A three-course self-paced path covering identity and phishing-resistant MFA, zero trust architecture implementation, and the FedRAMP move from Rev5 to 20x and CR26.
Everything you need to take a federal system through the full Risk Management Framework, from categorization to an authorization to operate.
Secure and govern AI in a federal environment — from the threat landscape to a working agency AI security and governance program.
A two-course self-paced path through federal cloud security: the fundamentals and FedRAMP context first, then cloud security architecture and hardening built on real recent breaches.
Covers the rules that govern sensitive information in federal work: protecting PII and PHI under the Privacy Act, recognizing and marking CUI, and managing federal records from creation through lawful disposition.
Prepare for the CISSP certification exam with comprehensive coverage of the 8 domains of information security, from risk management to network security and cryptography. Ideal for IT security professionals seeking career advancement or certification.
Conduct deep FedRAMP package due diligence, manage CSP accountability and continuous monitoring obligations, and design enterprise governance programs for multi-cloud federal portfolios.
Apply advanced 800-53A assessment techniques, build control overlays for cloud, OT, and AI/ML systems, and develop the enterprise governance skills to manage a federal security controls program.
Federal agencies are deploying AI faster than the practices meant to govern and secure it. This intermediate course helps federal staff and their partners build an agency AI governance and security program grounded in federal AI policy and the NIST AI Risk Management Framework—covering AI inventories and risk classification, data governance and privacy, the AI development and acquisition lifecycle, machine learning and generative AI threats, and the oversight and monitoring that keep AI trustworthy, ending with a capstone plan you build yourself.
The security control assessor makes the independent judgment an authorizing official relies on. This advanced course develops that craft end to end—establishing independence, scoping the assessment, tailoring NIST SP 800-53A procedures, and executing examine, interview, and test methods—so you can evaluate evidence, validate technical results, and write findings that survive scrutiny, culminating in a complete Security Assessment Report.
This course prepares you to operate effectively inside a federal Security Operations Center, whether you're new to SOC work or an analyst who wants to solidify the federal standards and terminology behind the job. Unlike generic SOC training, every operational topic—log collection, continuous monitoring, detection engineering, and incident response—is grounded in the statutes, policy memoranda, and technical standards that actually govern federal cyber defense.
Twelve hours of self-paced AI red teaming and assurance — engagement planning, adversarial testing technique, assurance cases, and testing agentic systems. No lab required.
Self-paced governance, risk and compliance across ten modules, covering FAIR quantification, SEC materiality, risk registers, control mapping, and an applied GRC workshop.
Twelve hours of self-paced C-SCRM built on NIST SP 800-161r1 — criticality analysis, supplier due diligence, acquisition requirements, software supply chain, and monitoring — current to August 2026 on federal policy.
Learn to conduct defensible digital forensics and incident investigations using the NIST SP 800-86 forensic process—Collection, Examination, Analysis, and Reporting. You'll master IOC investigation, chain of custody, and the federal legal and oversight framework, then put it all together in a full capstone investigation.
Run a federal incident response program end to end, organized the way NIST now organizes it: from governance and readiness, through detection and the one-hour CISA notification clock, to recovery and continuous improvement.
Evaluate FedRAMP-authorized cloud services, execute the agency ATO process, and manage shared security responsibilities across the cloud service lifecycle.
Understand what FedRAMP's move to 20x and the Consolidated Rules for 2026 change, and build a transition roadmap. Timed to the January 1, 2027 CR26 deadline.
Learn both static analysis (examining files without running them) and dynamic analysis (interpreting behavior from sandbox and monitoring reports), and build the judgment to know which technique fits each situation. Following NIST SP 800-83 Rev. 1, the course works in the real tools analysts rely on—disassemblers, sandboxes, YARA, network capture, and CISA's Malware Next-Gen—with a federal thread on sample sensitivity and data handling throughout.
Implement and assess security and privacy controls for federal information systems.
Self-paced AI/ML security across ten modules: adversarial machine learning, generative AI and prompt injection, model integrity, supply chain, and pipeline security.
Self-paced program-level training across eleven modules, treating security and privacy as one program and ending in a defended leadership briefing.
Take your existing threat hunting and detection engineering skills and build them into a defensible program, using a methodology sourced entirely from NIST, CISA, and DoD publications. You will learn a repeatable hunt process, bias-reducing analytic techniques, the full detection lifecycle, and the validation and metrics that prove risk is going down.
Twelve hours of self-paced cloud security across ten modules — architecture then operations — built on real breach case studies and closing with a hardening workshop.
Self-paced federal web application security across five two-hour modules, written for developers and oversight staff together. No lab environment required at any point.
Zero trust has moved from slogan to federal mandate, but knowing the principle is not the same as implementing it. These courses take you from the tenets and a current-state maturity assessment through the identity, device, network, workload, application and data pillars, and on to a staged implementation plan with governance and metrics.
Eight hours of self-paced AI security monitoring and incident response: the four monitoring categories, a signals table that maps what you observe to what it means, and the containment actions specific to AI systems.
An authorization to operate isn't the finish line—federal systems must be monitored continuously, with weaknesses tracked and risk reported to leadership over time. This intermediate course grounds Information Security Continuous Monitoring (NIST SP 800-137) in FISMA accountability: you'll design an ISCM strategy, manage findings through POA&Ms, and build the metrics and reporting that support ongoing authorization.
Learn the full NIST Risk Management Framework lifecycle, from categorizing a system to authorizing it to operate.
Self-paced ICAM training covering identity, proofing, authentication and MFA, authorization, federation, and the access decision — with a hard focus on which MFA methods actually resist phishing.
Most organizations now use AI rather than build it, so every security professional needs to treat AI as part of the attack surface. This foundational course—no AI/ML background needed—covers the AI threat landscape (MITRE ATLAS), the risks of LLM apps (OWASP Top 10 for LLMs), and the dangers of AI agents, tying it to the NIST AI Risk Management Framework and the everyday defenses that keep AI systems secure.
As agencies shift workloads to the cloud, the whole workforce needs a working grasp of how cloud security differs from on-premises security. This foundational course covers cloud service models, FedRAMP's role in federal cloud governance, and the shared responsibility model, then moves through identity and data protection, secure configuration, vulnerability management, and monitoring and incident reporting, closing with a capstone that evaluates a federal cloud service.
Practical cybersecurity awareness for the whole government workforce - threats, everyday habits, phishing defense, and the policies that shape your responsibilities.
Six hours of self-paced federal recordkeeping: what counts as a record, how retention and disposition schedules work, and how email, chat and collaboration platforms fit in.
Four hours of self-paced CUI training covering recognition, marking, safe handling, destruction, and incident reporting — plus the 2026 federal guidance on CUI and AI tools.
Self-paced insider threat awareness built to meet or exceed the free CDSE baseline: real indicators, reporting channels, and the whistleblower distinction most training avoids.
Three hours of self-paced telework and mobile security, written from the user's point of view: phishing-resistant sign-in, refusing MFA abuse, shadow AI, home networks, and reporting.
Spot and stop social engineering on every channel attackers use: email, text, voice, QR code, and the front door. Built to satisfy the federal annual security awareness requirement.
Three hours of self-paced federal privacy training: Privacy Act requirements, identifying PII and PHI, safeguarding duties, and what to do after a suspected breach.
Three hours of self-paced federal ethics across six modules — General Principles, conflicts of interest, gifts, misuse of position, employment restrictions, and the Hatch Act.
A plain-language overview of CMMC 2.0 for federal contractors - what it is, who must comply, the maturity levels, and the rollout timeline you need to plan around.
Understand Zero Trust for government - 'never trust, always verify,' the federal strategy and pillars driving it, and what it changes for everyday staff.
Since 1921, Graduate School USA has partnered with over 125 federal agencies and trained more than one million federal employees. Led by instructors with deep, real-world knowledge of federal regulations, policies, and practices, our private group programs are practical, mission-driven, and tailored to your agency’s objectives. We offer expertise across key federal domains—including human resources, financial management, acquisition and contracting, leadership, and more—to deliver training where and how your team needs it.
Complete this form and we’ll get back to you within 1 business hour.
Our alumni consistently commend the expertise of our instructors and the real-world relevance of our programs. Their feedback highlights how Graduate School USA training has advanced their skills, supported their agencies’ missions, and fostered long-term professional growth.
Overall, my experience in the Python Programming class was genuinely great. I enjoyed the hands-on learning environment, and having Art as my instructor made a huge difference. The class was definitely tough at times, but in the best way, it challenged me to really dig into the material and helped reinforce what I learned. I’m walking away with a much stronger understanding of Python and a lot more confidence in my abilities.
Brian is very thorough and extremely helpful. He has a very engaging style of teaching.
If you are serious about your learning, whether you have or don't have experience, Noble Desktop is the place for you. Between my instructor's 40+ years of teaching experience and the quality personnel, I know I'm in good hands. I actually believe I can be a Software Engineer now.
Immersive class with no problems.
Great professor! He made it interesting to learn.
I really like Noble Desktop and will recommend it to my veteran friends when they are looking to learn about software programming and engineering. I am learning exponentially more than just trying to study on my own.
Very good foundational class with good information for those just starting out in Python. Getting the class set up and scheduled was very smooth and the instructor was excellent.
Throughout my career, I've had several technical training sessions before this one. Boris was the most knowledgeable and clear instructor I've ever come across. I'll be requesting additional Python training in 2023 and would love to work with him again.
The instructors at Noble Desktop were kind, helpful, informative, and had patience with every student taking the course.
I had a great time with the Python course, and it was a breeze to learn.
Terrific curriculum and content, and a world-class instructor and hands-on practice. Couldn't have asked for a better overall experience. 10 stars out of 5!
I thought the content for the class provided good coverage of the foundations of Python. Art is a good instructor. I like his approach of teaching a concept, then giving us an exercise to work through.
I am learning what I wanted and in the right atmosphere with the right instructor. Art understands Python and knows how to drive its juice into our souls. He is patient and tolerant with us and has so many ways to make each format sink in.
At first, I was skeptical of Noble Desktop due to the low cost compared to those overly priced bootcamps. However, once Instructor Menninga started teaching, all my doubts went out the window. Besides the instructor(s), the registrar/administrative assistant is amazing! I overslept during the first day of class and nearly missed out - surprisingly, the administrative team contacted me via phone, not once but TWICE to ensure I attended class. I was so amazed by how much they put into their students. So much so that I would love to attend again someday. Thank you, Amit! Don't think twice about joining, just do it. Best Python bootcamp out there.
Showing 14 of 14 reviews
Attend courses in-person in Washington, DC or live online. Engage with expert instructors, ask questions, and get feedback on your exercises and projects.
Get face-to-face interaction with an instructor and other students when you learn at our DC campus. Courses are hands-on with a computer and software provided.
Get the same interactivity and access to the instructor as in-person students. There are no extra fees and we’ll work with you to ensure your remote setup is perfect.
All times are listed in Eastern Time unless otherwise specified.
| Course, dates, and times | Price and duration | Description | Registration |
|---|---|---|---|
| October 2026 | |||
|
October 1
Thursday
9–4:30pm
|
$699
6 Hours
|
Practical cybersecurity awareness for the whole government workforce - threats, everyday habits, phishing defense, and the policies that shape your responsibilities. |
|
|
October 15
Thursday
9–4:30pm
|
$899
1 Day
|
Most organizations now use AI rather than build it, so every security professional has to treat AI as part of the attack surface. This foundational course — no AI/ML background needed — covers the AI threat landscape (MITRE ATLAS), the risks of LLM apps (OWASP Top 10 for LLM Applications), and the dangers of AI agents, tying it to the NIST AI Risk Management Framework and the everyday defenses that keep AI systems secure. |
|
|
October 15–November 3
Weekdays
9–4:30pm
|
$1,875
20 Hours
|
Secure and govern AI inside a federal environment — from the threat landscape through to a working agency AI security and governance program. |
|
|
October 20
Tuesday
9–4:30pm
|
$799
1 Day
|
Work through every stage of the NIST Risk Management Framework, from setting a system's impact level to signing off on its authorization to operate. |
|
|
October 22
Thursday
9–4:30pm
|
$699
1 Day
|
A jargon-free grounding in how federal cloud services get secured and where one party's responsibility ends and the other's begins. |
|
Showing 5 of 234 courses