Description

A focused course, tailored for you

IAM Operations for Federal Cleared Environments

Build and run identity governance, access reviews, and PAM controls that hold up under FISMA and CMMC scrutiny.

Every FISMA access review surfaces the same three documentation gaps. This course eliminates them before the auditor arrives.

$199 one-time

Tailored to your situation. Access within 24 hours. 30-day money-back.

Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.

Why this course

IAM Operations Managers in federal and cleared environments run access reviews on a fixed calendar, but the artefacts those reviews produce are rarely audit-ready on the first pass. Account inventory exports do not match the authoritative system of record. Privileged account justifications exist in someone's inbox, not in the governance platform. Role certifications are signed but the audit trail does not capture the attestation scope. The result is overnight patching before every FISMA assessment, CMMC audit, or FedRAMP continuous-monitoring review. The problem is not the tools. It is the operational design: which artefacts are produced, in what format, tied to which control identifiers, and how the sign-off chain is documented. This course teaches that operational design from scratch, using the NIST 800-53 access control family as the control-mapping spine.

What you walk away with

Produce a complete FISMA-ready access review package, including account inventory reconciliation, privileged account justification memos, and role-certification audit trails, without overnight patching.
Map your IAM operational artefacts directly to NIST 800-53 AC and IA control families so every artefact has a clear control-identifier anchor.
Design a PAM operational runbook that satisfies CyberArk or SailPoint IdentityIQ audit-log requirements for CMMC Level 2 and FedRAMP Moderate.
Build a recertification workflow that produces sign-off evidence in the format your assessor's evidence-request letter specifies.
Establish a continuous-monitoring cadence that keeps your access posture current between formal assessment windows.
Document and communicate access-review scope to programme managers and contracting officers without requiring a separate compliance analyst.

The 12 modules

Module 1. The NIST 800-53 Access Control Spine

Maps every operational IAM artefact to the AC and IA control families. Covers AC-2 (account management), AC-3 (access enforcement), AC-17 (remote access), and IA-2 through IA-8. For each control, identifies the specific evidence an assessor requests and the operational action that produces it. Builds the control-to-artefact matrix you will use throughout the course.

Module 2. Account Inventory Reconciliation

Covers the three sources that must reconcile before every access review: your IGA platform export, the authoritative HR or contractor roster, and the system-of-record in each integrated application. Teaches the reconciliation query pattern, the exception-log format, and the sign-off memo that closes out discrepancies for assessors. Includes a downloadable reconciliation template tuned for SailPoint IdentityNow and IdentityIQ exports.

Module 3. Privileged Account Justification Memos

Explains what a PAM justification memo must contain to satisfy an AC-6 least-privilege finding: role title, business need, approver identity, approval date, and the specific system and permission scope. Covers the difference between standing privileged access and just-in-time access and how to document each. Provides a two-page memo template your team can complete in under twenty minutes per account.

Module 4. Role Certification Design

Teaches how to structure a role-certification campaign so the sign-off chain is auditable: certifier identity, certification scope, decision (approve, revoke, remediate), and timestamp. Covers how to configure SailPoint certification campaigns to export an audit-ready CSV and how to supplement that export with a narrative attestation memo when the assessor wants more than a system log.

Module 5. PAM Platform Audit Logs

Covers CyberArk Privileged Access Manager and BeyondTrust audit-log exports in the context of CMMC Level 2 AU control requirements. Explains which log fields map to which control identifiers, how to produce a session-recording inventory, and how to present vault-access logs in a format that satisfies both the CMMC assessor and the programme security officer without requiring custom reporting scripts.

Module 6. FedRAMP Continuous Monitoring Access Controls

Walks through the monthly and quarterly access-control deliverables in the FedRAMP Continuous Monitoring Strategy Guide: account management report, privileged user list, and access control policy review. For each deliverable, specifies the data source, the format, and the submission artefact. Includes a recurring task checklist your team can adapt to your FedRAMP programme manager's reporting cadence.

Module 7. CMMC Level 2 Access Practice Implementation

Maps the CMMC Level 2 access control practices (AC.L2-3.1.1 through AC.L2-3.1.22) to your operational artefacts. Identifies which practices are commonly cited as gaps during CMMC assessments and why. Teaches how to close each gap with a specific operational change and a corresponding evidence artefact, rather than a policy rewrite that does not change daily behaviour.

Module 8. Contractor and Non-Employee Access Governance

Covers the access lifecycle for contractors, subcontractors, and temporary staff in cleared environments: onboarding provisioning tied to contract start date, periodic recertification aligned to contract periods of performance, and offboarding triggers that do not depend on manual HR notification. Explains how to document this lifecycle in a way that satisfies both the ISSO and the contracting officer's security clauses.

Module 9. Separation of Duties and Conflicting Access

Teaches how to identify and document separation-of-duties conflicts in your role model, how to build a SoD conflict matrix from your IGA platform data, and how to produce a compensating-control memo when a conflict cannot be eliminated. Covers how assessors evaluate SoD evidence under NIST 800-53 AC-5 and what the common gap patterns look like in a cleared-facility environment.

Module 10. Access Review Package Assembly

Brings together all prior module artefacts into a single access review package: cover memo, account inventory reconciliation, role certification results, privileged account justification log, exception log with remediation status, and control-to-artefact cross-reference table. Covers how to structure the package for a FISMA annual assessment versus a CMMC triennial assessment versus a FedRAMP continuous-monitoring review, as each has a different audience and a different evidence format preference.

Module 11. Communicating Access Posture to Non-Technical Stakeholders

Teaches how to summarise access review results for programme managers, contracting officers, and AOs without requiring them to read the full evidence package. Covers the one-page access posture brief format: open findings by severity, remediation timeline, and residual risk acceptance. Explains how to answer the three questions a contracting officer always asks without sending them a SailPoint export.

Module 12. Building a Sustainable Access Operations Cadence

Covers how to design a recurring access operations calendar that keeps your posture current between formal assessments: weekly provisioning hygiene checks, monthly privileged account reviews, quarterly role certifications, and annual full-scope reconciliation. Includes a 12-month operations calendar template and a staffing model that shows how to distribute the workload across a three-to-five person IAM operations team without creating single points of failure.

How this addresses your situation

Specific modules that map to what you said you are dealing with.

The FISMA assessor's evidence-request letter arrives and three artefacts are missing or in the wrong format: modules 1, 10.

A privileged account was active for 60 days past the contractor's offboarding date: modules 3, 8.

The role certification campaign ran but the audit-trail export does not satisfy the assessor's sign-off scope requirement: modules 4, 10.

The CMMC assessment identified AC.L2-3.1.3 as a gap and the remediation plan needs specific operational evidence: modules 7, 9.

What you get with this course

12 written modules in the Art of Service learning environment, each with a downloadable template or worked example.
Account inventory reconciliation template (CSV format, tuned for SailPoint exports).
Privileged account justification memo template (two-page Word format).
Role certification audit-trail supplement memo template.
Access review package assembly guide with section-by-section instructions.
12-month access operations calendar template.
Hand-built implementation playbook delivered alongside course access, tailored to federal cleared environments.

What you will have in hand by Day 1, Week 1, Month 1

Access to all 12 modules and downloadable templates upon enrolment.

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.

Before and after

Before

The access review package requires two days of overnight patching before every FISMA or CMMC assessment because the artefacts are in the wrong format, missing reconciliation documentation, or lacking the sign-off chain the assessor specified.

After

The access review package is assembled from artefacts your team produces as part of normal operations. The assessor receives a complete, correctly formatted package on day one. No overnight patching. No findings on artefact format.

What happens if you do not address this

Each assessment cycle that runs without a documented artefact design produces the same overnight patching problem and the same minor findings. Over time, repeat minor findings become pattern findings that attract programme-level scrutiny and can affect contract renewals in cleared environments where audit posture is part of the performance record.

Who it is for

IAM Operations Managers and senior IAM engineers at defence contractors, federal system integrators, and cleared-facility organisations who own the access review cycle, the PAM platform, and the audit-evidence package for FISMA, CMMC, or FedRAMP assessments. You have the tooling (or are mid-procurement). What you need is the operational design that connects daily provisioning work to the audit evidence your assessors actually request.

Who this is NOT for. Commercial SaaS IAM teams with no federal compliance obligations. Organisations still in the identity discovery phase who have not yet stood up an IGA platform or PAM solution. Entry-level analysts who do not yet own an audit cycle.

How it arrives

Text-based course in the Art of Service learning environment, plus downloadable templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.

Time investment. Each module is designed to be read and applied in 45-60 minutes. Most IAM Operations Managers complete the full course across two to three working weeks, applying each module's template to their own environment before moving to the next.

Why $199 is the right number

NIST 800-53 documentation is public but does not tell you which operational artefacts to produce or how to format them for an assessor. IGA and PAM vendor training covers the platform, not the compliance-evidence design. A compliance consultant engagement to redesign your access review process typically runs $15,000-40,000 and produces a policy document rather than operational templates. This course produces the templates directly, at $199.

FAQ

Does this course assume I already have SailPoint or CyberArk deployed?

No. The operational design principles apply to any IGA or PAM platform, and the templates are format-agnostic. Platform-specific guidance is provided for SailPoint IdentityIQ, SailPoint IdentityNow, and CyberArk PAM as the most common deployments in federal cleared environments, but the artefact logic works equally well with other tooling or with manual processes you are in the process of replacing.

Is this course specific to one type of assessment, or does it cover FISMA, CMMC, and FedRAMP?

All three. Modules 1 through 6 build the core artefact design that applies across all three frameworks. Modules 6 and 7 cover the framework-specific deliverables and evidence formats for FedRAMP continuous monitoring and CMMC Level 2 respectively. Module 10 covers how to assemble the access review package for each assessment type, as the audience and format requirements differ.

How current is the CMMC content?

The course covers CMMC Level 2 under the current CMMC 2.0 rule. The access control practices mapped are from the current CMMC Assessment Guide, Level 2, aligned to NIST SP 800-171 Revision 2.

30-day money-back guarantee. If after a week of working through the materials this is not what you needed, reply to the receipt email and a full refund is processed. No questions, no forms.

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.