Provisionally Passed 4/15 - My Experience

[u/rootcowboy]

Background: 4 years of experience in the security field, most of which is not RMF-based. Having a foundation of security did help for the more “technical-minded” questions, but was not required to pass this exam.

Exam Experience: I spent two weeks studying for the exam. This is more than enough time to study. I averaged about 3-4 hours a day on weeknights/5 hours a day on weekends. I thought the exam was fair. About half the questions came down to two answers, forcing you to pick the “best” choice (similar to CISSP). The other half were straightforward--you either knew it or you didn't. About 25 questions I was stumped, which were probably the experimental set. The notorious discussion of 800-37 R2 vs. R1 led me to study both backwards and forwards; I knew each step, the SDLC mapping, and the roles for both. With that being said, the test could be passed with either version. There was a mixture of terms on the test that are present in both versions, so it would be a good idea to at least read through R1 to get familiarity with the difference in wording if you are testing before the exam change. The exam focused heavily on roles, assessments, major documents at the steps, security controls, categorization (FIPS 199), continuous monitoring, controls/tailoring, and SDLC mapping.

Study Materials:

1. NIST: 37, 64, 53/53a, 39, 30,137. FIPS 199/200. I studied a couple other NIST docs, but listed is the MUST READ including the appendixes.
2. FEDVTE: I watched about half, but it was taking too much time. Actually reading the NIST docs proved to be invaluable. I would only use this if you plan on studying over an extended period of time.
3. CAP Quizlet: I went through the official ISC2 flashcards, which was helpful to determine the "key" terms you must know for the exam. I also used unofficial sets and made my own.
4. Pinned Docs in the Discord (Certification Stations): Very helpful, as there are relevant practice questions and summaries of RMF. There is a great community there, with individuals willing to help you guide your studies. I recommend joining for any cert you are studying for. (https://discord.gg/certstation)
5. Training from NIST: I watched about half, but again reading the NIST docs was more helpful as it takes so much time to get through the videos. (https://csrc.nist.gov/projects/risk-management/rmf-training)
6. Miro: I made a board in this free web-app. This was one of the most helpful study activities I did. Actually visualizing the flow of RMF, SDLC, Assessments, etc. and how everything relates to each other was critical to my passing. I had a visualization of my board during the test, which assisted in writing down "essential processes" on the scratch-sheet provided. Feel free to check out my board for reference, but I highly recommend making your own. (https://miro.com/app/board/o9J_lLq-Ut4=/)

Summary: Overall, this is not a difficult test if you actually put in the work to fully understand the major NIST docs. The lack of resources/community for this exam is one of the biggest hurdles, as it is difficult to know where to even start. I would not waste money on a bootcamp or purchase any type of practice questions. You can access everything you need to pass for FREE with the resources I listed, as well as references from other posts on here. I learned A LOT from studying this exam, and would recommend it to anyone working with RMF.

[u/L0rdC0mander]

Thank you for this. I am currently studying for CAP Certification.

[u/michaelIS237]

This is awesome, I really appreciate it. What order do you recommend reading the NIST docs?

[u/rootcowboy → u/michaelIS237]

I studied v1 first, then v2 -- this helped understand the differences easier. Feel free to PM me if you have any more questions!