“CIAGRC™”
Certified in Information Assurance GRC (IAGRC)™
Certification Training

Upon successful completion of this course, participants will be able to:

• Explain the principles and goals of Information Assurance (IA) in organizational and operational contexts.

• Apply assurance-oriented frameworks and lifecycle models (e.g., NIST RMF, ISO/IEC 27005, DIACAP-equivalent) to manage risk and compliance.

• Conduct risk assessments that consider confidentiality, integrity, availability, non-repudiation, and authenticity.

• Support the development and enforcement of information assurance policies and system security plans.

• Interpret and implement compliance controls from IA-relevant regulations and standards (e.g., FISMA, FedRAMP, ISO/IEC 27001).

• Assist with audit preparation, documentation, and the validation of system trustworthiness.

• Communicate IA risks, assurance levels, and system controls effectively to project teams, auditors, and risk stakeholders.

Module 1: Foundations of Information Assurance and GRC

Define Information Assurance and differentiate it from traditional cybersecurity.
Identify the principles of GRC and how they support IA objectives.

Module 2: Assurance-Based Risk Management

Explore risk categories in IA (e.g., integrity failures, availability disruptions).
Apply lifecycle-based risk assessment methodologies (e.g., NIST RMF, ISO 27005).

Module 3: Frameworks, Standards, and Lifecycle Models

Use information assurance frameworks such as NIST SP 800-37 and ISO/IEC 27001.
Understand system authorization processes and continuous monitoring principles.

Module 4: IA Compliance and Control Implementation

Map IA requirements to compliance standards like FISMA, FedRAMP, and SOC 2.
Align system and organizational controls with regulatory obligations.

Module 5: Policy, Documentation, and Audit Support

Develop assurance-related policies, security plans, and documentation artifacts.
Prepare for system-level or organization-level IA audits and assessments.

Module 6: Communication and Collaboration in IA

Develop reporting skills for system status, assurance levels, and compliance posture.

Coordinate with development teams, auditors, legal, and compliance staff.

1. Information Assurance Principles and GRC Foundations – 15%

Covers core concepts of information assurance, including the principles of confidentiality, integrity, availability (CIA), and how governance, risk, and compliance frameworks integrate with IA objectives.

2. Risk Management and Assessment Methodologies – 20%

Focuses on identifying, assessing, and mitigating assurance-related risks using models such as the NIST Risk Management Framework (RMF), ISO/IEC 27005, and DIACAP. Emphasizes lifecycle-based and control-oriented risk assessment approaches.

3. IA Frameworks, Standards, and Lifecycle Models – 20%

Examines key IA frameworks and standards (e.g., NIST SP 800-37, ISO/IEC 27001) with an emphasis on system authorization, continuous monitoring, and integrating lifecycle approaches for managing assurance.

4. Regulatory Compliance and Control Implementation – 15%

Addresses mapping IA practices to compliance mandates like FISMA, FedRAMP, SOC 2, and others. Focuses on aligning organizational controls with regulatory requirements and implementing effective safeguards.

5. Policy Development, Documentation, and Audit Readiness – 15%

Emphasizes creation and management of security policies, documentation (e.g., SSPs, POA&Ms), and audit support processes that demonstrate system trustworthiness and readiness for assessment.

6. Communication and Stakeholder Collaboration – 15%

Develops communication and collaboration skills needed to convey assurance status, risk exposure, and control effectiveness to both technical and non-technical stakeholders including auditors, developers, and executives.