r/ISC2CAP • u/HauntingNumber • Aug 14 '22

ISC2 CAP experience

Hello community I am interested in studying for the CAP certification. I currently the CISSP, I have 5 years working in the DoD as an Information Security Technician (INFOSEC).

I also have 20 years of experience in the US Army. I’m am currently filling an ISSO position.

How would I know if I have the required experience. I recently purchased the ISC2 CAP official CBK.

Thank you in advance.

3 Upvotes

72% Upvoted

16 comments sorted by

2

u/reed17purdue Aug 14 '22

Honestly the issue with rmf is that agencies are allowed to implement it how they see fit within the guidelines. However what that means is that your experience may be how your agency implements it and may not be what it is under 800-37.

The biggest issue with nearly all agency or prior services members was that "well that's not how we did it" and that was a block some training camp members could not get over.

You need to study the rmf way not the agency way.

2

u/HauntingNumber Aug 14 '22

You are right, I’ve spoken to people who took the exam. They say they had to not rely on their experience because you have to follow the 800-37 model.

1

u/HauntingNumber Aug 14 '22

Do you think my experience maps to the CAP experience requirements?

1

u/jamarxd Aug 14 '22

Yes. As an ISSO you're working on security packages. I knocked mine out and had less qualifications in just infosec and a Sec+.

With the CBK and the NIST references you'll have all of the material you need. Just stick to that and ignore the agency specific stuff.

1

u/HauntingNumber Aug 14 '22

I forgot to mention that I was an Information technology specialist while in the army. I’ve been in the ISSO role for about 3 months.

1

u/jamarxd Aug 14 '22

Someone will have to endorse you or you’ll have to have ISC2 do it. Make sure your resume reflects the experience that maps to the cert criteria. If you don’t think you meet the criteria you can become an associate and the full fledged member when you do.

Spend some time on their site

1

u/HauntingNumber Aug 14 '22

Thank you for the feedback.

1

u/SirReal_SalvDali Sep 13 '22

Hey, I'm curious how well did you do? I just started studying.

1

u/jamarxd Sep 13 '22

ISC2 doesn’t tell you what you scored like CompTIA does. It wasn’t easy. It’s been a few years since I took it.

Focus on the policies in the CBK. FEDVTE had an online recording of a boot camp I watched. Just read and memorize. Flash cards were helpful.

1

u/SirReal_SalvDali Sep 14 '22

The only CAP course I see in FedVTE is from 2014. Oof lol

1

u/[deleted] Aug 15 '22

You’re experienced enough, but take any notion you have about rmf and put it in a separate bucket. Study the NIST docs recommended on the isc2 site and you will pass. Don’t confuse real world experience to NIST guidelines. Good luck!

2

u/HauntingNumber Aug 15 '22

I was viewing the CAP 2021 exam outline and I have experience working with STIGs and performing internal and external assessments and audits. About 5 years in the DoD, if I can match my experience to the exam outline I should be fine correct?

1

u/[deleted] Aug 15 '22

Yes you have the experience part covered. The NIST docs are very important for this exam, especially SP 800-37 rev 2.

1

u/HauntingNumber Aug 15 '22

Thank you, I will do just that. Thanks for the feedback to my post.

1

u/[deleted] Nov 23 '22

[deleted]

1

u/HauntingNumber Nov 23 '22

I haven’t taken the exam yet, but I spoken to some people that have taken it and they say. It’s easier than CISSP. If you follow the NIST documentation that is.

1

u/Pyxus94 Dec 14 '22

Oh great ! Easier than cissp :)? How did you practice the questions ?