Practitioner Program
Seven weeks, live, walking the full RMF cycle end to end: categorize, select, implement, assess, authorize, monitor. You leave with real interview preparation and a practitioner tool you keep using after the cohort ends.
Cohorts are kept small and run as interest allows — reach out and we’ll tell you what’s next.
Each step is taught through a working system: categorized, controlled, implemented, assessed, authorized, and monitored over the seven weeks.
Define system impact and risk profile against NIST SP 800-60 and FIPS 199.
Tailor controls from NIST SP 800-53 to the system, mission, and risk tolerance.
Deploy and document controls in language an assessor (and an auditor) can read.
Examine, interview, and test against the documented implementation.
Build the package an AO can sign: risk-based, evidence-backed, defensible.
Establish continuous monitoring that feeds the next cycle and survives turnover.
Practitioner Program
Cohorts are kept small. Tuition shared on request.
Live cohort instruction, graded assignments, office hours, and an authorization project. Includes ongoing Work OS access.
A self-paced course teaches the framework. It doesn’t review your actual work, doesn’t give you something concrete to show in an interview, and doesn’t hand you a tool you keep using afterward. That’s the gap between knowing RMF and being trusted to run it.
No. The RMF is a federal framework, but the same control logic (access management, evidence, assessment) maps directly to SOC 2, ISO 27001, and CMMC work in the private sector and at the state and local level.
Access to program materials and live classes pauses until the balance clears.
Yes. Checkout runs through Stripe. Card, Klarna, and Afterpay are all accepted directly at checkout.
Share a few details and we'll follow up with program specifics and next steps.