Module 10 Capstone: Simulated System Authorization
What you will be able to do
- Categorize a system and define its boundary from a scenario pack.
- Select controls, apply parameters, and write implementation statements for a control sample.
- Assess the sample and document findings.
- Produce POA&M entries, a monitoring approach, and a security impact analysis.
- Brief the authorizing official with a defensible recommendation.
Lessons
The lessons, exercise, and quiz are for registered learners. Create a free account or sign in to read them.
- 1. Approaching the Capstone · 25 min Completed
Capstone
- Capstone workspace: write and submit your six tasks. Injects and the examiner's guide are released here.
- The six tasks · Scoring rubric
Scenario packs
- Scenario Pack 1: GrantLink System Brief
- Scenario Pack 2: Architecture, Services, and Connections
- Scenario Pack 3: Interview Notes
- Scenario Pack 4: Evidence Pack
- Scenario Pack 5: Agency Policy Extract
- Scenario Pack 6: Injects (released in the workspace as you submit tasks)
Final knowledge check
- Practical exercise: Capstone Tasks: Reauthorizing GrantLink
- Module quiz (20 questions, pass mark 80 percent)
Templates and files
Overview
The capstone repeats the whole chain you have built on TreasuryFlow, this time on a system you have not seen and without scaffolding. GrantLink is a fictional grants management system whose authorization expires in 45 days. You are its new Information System Security Officer (ISSO). You will find out what is wrong, decide what cannot wait, assess a sample of controls, plan the fixes, review the third parties, and recommend a decision to the authorizing official (AO), while three new events arrive along the way.
Builds on
Every module. In particular: categorization (Module 2), controls and parameters (Module 3), implementation statements (Module 4), findings (Module 5), decisions (Module 6), POA&M and change (Module 7), vendors (Module 8), and AI (Module 9).
Contents
| Item | What it is | Status |
|---|---|---|
| Lesson 1: Approaching the Capstone | How it is scored, how to read the evidence, how to plan | New |
| Scenario packs 1 to 5 | System brief, architecture, interviews, evidence, policy extract | New |
| Scenario pack 6 | Three injects, released between tasks | New |
| Capstone tasks | Six tasks producing a mini authorization package | New |
| Package template | One document with a section for each task | New |
| Scoring rubric | 100 points, pass mark 70, six critical errors | New |
| Examiner's guide | A strong answer, unlocked after submission | New |
| Final knowledge check | 20 questions across Modules 1 to 9; pass mark 80% | New |
Completing the capstone
You complete the course when you have:
- passed the final knowledge check at 80%;
- scored 70 or more on the package, with no task at "Not yet";
- made none of the six critical errors in the rubric.
What is binding here, and what is guidance
| Source used in the capstone | Kind | Why it has that status |
|---|---|---|
| FISMA, OMB Circular A-130, FIPS 199 and 200 | Binding | As in Modules 1 to 3 |
| CISA BOD 26-04 (applied through the policy extract) | Binding on federal civilian agencies | As in Module 7 |
| NIST SP 800-37, 800-53, 800-53A, 800-53B | Guidance, required in practice | As in Modules 2 to 6 |
| The scenario's agency policy extract | Course values standing in for agency policy | Fictional; treated as binding within the exercise |
| The scenario's information type register | Course values | Not NIST SP 800-60 values |
| The rubric and examiner's guide | Course standard | How this course judges the work |
Module summary
- Read evidence three times: triage for what is happening now, control by control against criteria, then for what nobody asked about.
- Act on urgent items on the day you find them; the package records that you did.
- Categorize on impact, show the reasoning, and check that privacy documents still describe the system.
- Assess against the evidence and the policy, including the good news.
- Turn findings into owned, dated work, and watch the failed controls more closely.
- Treat new vendors and AI features as changes that need review.
- Brief the AO in risks, not control numbers, and recommend; never decide.
What comes next
When you finish, the electives remain open: E1 Operational Technology and E2 GRC Engineering.
Last reviewed 2026-11-12. Federal requirements, dates, and web addresses change. Before you rely on a date, deadline, or figure, open the source linked in the lesson.