ISSO & Security Assessor Bootcamp
Become an ISSO or Security Assessor.
A role-based bootcamp that walks you through the entire NIST Risk Management Framework, from Prepare to Monitor, building the real artifacts (SSP, SAP, SAR, POA&M) federal employers expect. Finish with a portfolio and the language of the job.
Choose how you learn
One bootcamp. Three ways to take it.
3Same role-based outcome. Pick the format that fits your life. Read it at your own pace with graded feedback, watch the video track, or join the live quarterly cohort.
Instructor-led
Watch the instructor teach on video: a guided track with self-checks, per-module interview prep and a hands-on lab.
Available now in the Fourth Tech Hub
Self-paced
Read the full course in the portal at your own pace: lessons, graded quizzes and assignments your instructor reviews.
Available now in the Fourth Tech Hub
Live cohort
Real-time sessions with the practitioner on a quarterly schedule: accountable, interactive, and capped for attention. We open these as cohorts are scheduled.
Next cohort · To be announced
Roles this prepares you for
- Information System Security Officer (ISSO)
- Security Control Assessor / Security Assessor
- RMF Analyst
- Compliance Analyst
- Junior SCA support
Standards & references
You'll build a portfolio of
- Mini SSP
- Security categorization memo
- POA&M
- Sample finding
- Mock authorization summary
- Cloud boundary worksheet
The curriculum
The 12 modules
12Federal Cybersecurity & RMF
FISMA, why RMF exists, ATO concepts, the ISSO & assessor roles.
Roles, Governance & Docs
AO, ISSO, ISSM, SCA, and how SSP/POA&M/SAP/SAR connect.
RMF Step 1: Prepare
System boundaries, scoping, inheritance, readiness checklist.
RMF Step 2: Categorize
FIPS 199/200, 800-60, impact levels, categorization workshop.
RMF Step 3: Select
800-53 baselines, tailoring, overlays, control families.
RMF Step 4: Implement
Implementation statements, building the SSP, defensible narratives.
RMF Step 5: Assess
800-53A, Security Assessment Plan, findings, the SAR, mock assessment.
RMF Step 6: Authorize
Authorization package, POA&M, residual risk, executive risk summary.
RMF Step 7: Monitor
ConMon strategy, vulnerability management, SSP/POA&M updates, metrics.
ISSO & Assessor Job Readiness
Day-in-the-life, interview questions, deliverables, capstone briefing.
Cloud for RMF Professionals
Service/deployment models, shared responsibility, cloud boundaries.
FedRAMP for ISSOs & Assessors
FedRAMP roles, baselines, documents, continuous monitoring, inheritance.
The challenge
You know the seven steps. Can you write the package?
Federal and defence compliance hires on documents. The interview is not whether you can name the RMF steps, it is whether an authorizing official would sign what you wrote.
The framework as a diagram
RMF is usually taught as seven boxes and an arrow. The job is the artefact each box owes, and who refuses to accept it when it is thin.
Nobody teaches the writing
An ISSO's week is an SSP section, a POA&M item and a monitoring report. Control implementation statements are a form of technical writing, and it is a learnable one.
Two sides of the same control
An assessor and the assessed read 800-53 differently. Most training picks a side, so the first time you meet the other one is on a real package.
The transformation
From reciting the RMF to writing the package
Three programmes in one: the framework end to end, the 800-171 control set in depth, then assessment and assurance from the other side of the table.
You can name the seven RMF steps
You can run them, and say which artefact each step owes and to whom
A control is a line in 800-53
You write an implementation statement that survives assessment, and can reject a weak one as the assessor
FIPS 199 is a table you have seen
You categorise a system and defend the impact level in a memo
A POA&M is a spreadsheet somebody else keeps
You open a finding, scope the milestones and write the residual risk
800-171 is the one people mention alongside CMMC
You map it to 800-53 and can explain what an SPRS score is actually counting
Your proof of learning is a certificate
A portfolio: an SSP section, a SAP, a SAR finding, a POA&M and a monitoring report
Describes the capabilities this programme is designed to develop. Results vary with experience and effort. Completing a programme does not guarantee employment, promotion or acceptance by any employer.
The programme in numbers
What you actually receive
58.5
Hours of instruction
20
Modules
62
Lessons
20
Graded quizzes
10
Marked assignments
3
Courses included
Counted from the courses this enrolment grants, not written by hand, so they cannot drift from what you receive.
- ISSO & NIST RMF Bootcamp — 6 modules, 31 hours
- NIST 800-171 Controls in Depth — 4 modules, 10h 30m
- Cybersecurity Audit & Assurance (Advanced) — 10 modules, 17 hours
Curriculum
What you will study, module by module
Phase 1: The RMF end to end, as an ISSO
- 1.The ISSO Role & the Risk Management Framework5 hours
- 2.RMF Categorize & Select: FIPS 199 and the 800-53 Baseline5 hours
- 3.RMF Implement & Assess: SSP, Assessment Methods, SAR & Findings5 hours
- 4.RMF Step 6, Authorize: The Package, the Risk Decision, and the ATO5 hours
- 5.Continuous Monitoring: the ISSO's Daily Work6 hours
- 6.The ISSO Toolkit & Capstone5 hours
Phase 2: NIST 800-171 controls in depth
- 7.The Control Set and the CUI It Protects1h 30m
- 8.Scoping a CUI Environment3h 30m
- 9.The 110 Controls, Family by Family, and How They Are Assessed2h 30m
- 10.Writing the SSP and the POA&M3 hours
Phase 3: Assessment and assurance
- 11.Risk-Based and Integrated Audits1h 30m
- 12.Testing Across NIST, ISO, and SOC Simultaneously1 hour
- 13.Control Rationalization, Crosswalks, and Data Analytics1 hour
- 14.Assurance Reporting, Program Management, and QA1h 30m
- 15.Auditing AI and Automated Decision Systems2 hours
- 16.Auditing Cloud Environments2 hours
- 17.Auditing DevSecOps and CI/CD Pipelines2 hours
- 18.Auditing Privacy and Data Protection Controls2 hours
- 19.Continuous Auditing and Continuous Controls Monitoring2 hours
- 20.Fraud Risk, Management Override, and Forensic-Aware Auditing2 hours
Calendar
A plan that fits around work
Week 1
10 hours
- 1.The ISSO Role & the Risk Management Framework
- 2.RMF Categorize & Select: FIPS 199 and the 800-53 Baseline
Week 2
10 hours
- 3.RMF Implement & Assess: SSP, Assessment Methods, SAR & Findings
- 4.RMF Step 6, Authorize: The Package, the Risk Decision, and the ATO
Week 3
11 hours
- 5.Continuous Monitoring: the ISSO's Daily Work
- 6.The ISSO Toolkit & Capstone
Week 4
7h 30m
- 7.The Control Set and the CUI It Protects
- 8.Scoping a CUI Environment
- 9.The 110 Controls, Family by Family, and How They Are Assessed
Week 5
10 hours
- 10.Writing the SSP and the POA&M
- 11.Risk-Based and Integrated Audits
- 12.Testing Across NIST, ISO, and SOC Simultaneously
- 13.Control Rationalization, Crosswalks, and Data Analytics
- 14.Assurance Reporting, Program Management, and QA
- 15.Auditing AI and Automated Decision Systems
Week 6
10 hours
- 16.Auditing Cloud Environments
- 17.Auditing DevSecOps and CI/CD Pipelines
- 18.Auditing Privacy and Data Protection Controls
- 19.Continuous Auditing and Continuous Controls Monitoring
- 20.Fraud Risk, Management Override, and Forensic-Aware Auditing
Total 58h 30m across 20 modules. Hours are the time the material is built to take, not a cap: nothing stops you going slower or faster.
Fit
Is this programme for you?
This is for you if
- You are moving into federal or defence compliance from IT, audit, help desk or an adjacent field.
- You have studied the RMF and cannot yet produce a document somebody would accept.
- You want both sides, ISSO and assessor, because contracts staff both and the pay follows the second.
- You will do the written assignments. The package is the point, and it is marked.
This is not for you if
- You want a certificate for a CV line without doing the written work.
- You need an accredited or regulator-recognised qualification. This is a Fourth Tech certificate, not an accredited award, and we say so rather than implying otherwise.
- You want hands-on technical security engineering. This is governance, assessment and documentation work.
- You are looking for CAP, CISSP or CMMC exam preparation. This is role training and the exam-prep courses are a separate offering.
- You want to join a live cohort today. Live cohorts for this programme are announced quarterly; the self-paced programme opens the moment you enrol.
Outcomes
What you will be able to do
- Run the NIST Risk Management Framework from Prepare to Monitor and name the artefact each step owes
- Categorise a system under FIPS 199 and SP 800-60 and defend the impact level in writing
- Select and tailor an 800-53 baseline, and write implementation statements that survive assessment
- Plan an assessment, write findings against 800-53A and assemble the SAR
- Open and run a POA&M, and write the residual risk summary an authorizing official reads
- Map NIST 800-171 to 800-53 and explain what an SPRS score is counting
- Stand up continuous monitoring: the strategy, the metrics and the monthly report
What you need
- No federal experience. The programme starts at why FISMA and the RMF exist at all.
- A computer with a modern browser. The labs run in the browser, so no virtual machine and no particular operating system.
- Time for the written assignments. They are marked against a rubric, and skipping them removes the only thing that distinguishes you afterwards.
- No clearance and no government post. Every example is built from public references, so nothing here depends on access you do not have.
Your path to the certificate
- 01
Enrol
Pay once and all three courses open in your portal immediately.
- 02
Work the phases
The RMF end to end as an ISSO, then the 800-171 control set in depth, then assessment and assurance from the assessor's seat.
- 03
Submit the assignments
Each module has a quiz marked on our server and an assignment marked against a rubric.
- 04
Build the package
The capstone is an authorization package you assemble yourself, and it becomes the centrepiece of your portfolio.
- 05
Earn the certificate
Issued with a unique ID and a public verification page anyone can check.
Hands-on labs
You don't watch. You do.
9Next cohort · To be announced
Secure your seat for $2,000.
You're in as soon as you pay: the full program opens in your portal right away, to work through at your own pace. When a live cohort is scheduled you'll get its day-by-day plan and sessions as well, and cohorts are capped at 20 seats.