About

Why this course exists

Most new Information System Security Officers (ISSOs) learn the job by watching someone else and asking questions. That works when there is time and a patient colleague. Often there is neither. This course writes down what a good ISSO knows: not only the steps of the Risk Management Framework, but why each step exists and what goes wrong when it is skipped.

How it is built

• Plain language. Every acronym is spelled out the first time it appears in a module.
• Binding versus guidance. Every module ends with a table separating what the law and policy require from what is good practice.
• Sources you can check. Lessons cite their authoritative sources with links. Where something was uncertain when written, the lesson says so.
• Fictional practice systems. Three made-up systems run through the course: CivicCRM (Low), TreasuryFlow (Moderate, with personal information), and SentinelBAS (High, operational technology). The capstone adds a fourth. None of them is a real system.
• Versioned and reviewed. Every module shows its version and the date it was last reviewed. Lessons that depend on fast-changing policy are reviewed at least every six months.

Who made it

ISSPM Academy was created by an experienced federal Information System Security Program Manager who supervises ISSOs. The course draws on years of practical work, generalized so that nothing in it is specific to any agency or system.

What it is not

This is an independent training resource. It is not official guidance and is not affiliated with or endorsed by any federal agency or vendor. Every system, person, organization, and scenario in the course is fictional. Requirements change: always check the current source and follow your own agency's policy.

Privacy

To track progress we store your name, email address, optional background, lesson completions, quiz results, and, if you take the capstone, the answers you write in the capstone workspace and your self-assessment scores. We do not store passwords: you sign in with a link sent to your email. We do not sell or share your information. To have your account and everything stored with it deleted, or to ask what we hold about you, email privacy@kentek.us.com from the address you registered with.