Module 9 Emerging Security Modernization
What you will be able to do
- Explain Zero Trust, rate a system pillar by pillar, and write a gap note.
- Explain the post-quantum threat and requirements, and build a starter cryptographic inventory.
- Describe a logging architecture and write a system logging profile.
- Apply federal AI policy and AI-specific security risks to a proposed AI component.
- Absorb a new federal requirement from source to plan.
Lessons
The lessons, exercise, and quiz are for registered learners. Create a free account or sign in to read them.
- 1. Zero Trust in Practice · 50 min Completed
- 2. Post-Quantum Cryptography and the Cryptographic Inventory · 45 min Completed
- 3. Logging and Telemetry Architecture · 35 min Completed
- 4. Artificial Intelligence in Authorized Systems · 45 min Completed
- 5. Absorbing New Requirements · 30 min Completed
Practice and quiz
- Practical exercise: A Starter Cryptographic Inventory and a Zero Trust Gap Note
- Module quiz (10 questions, pass mark 80 percent)
Overview
This module covers four areas where federal requirements moved fastest in 2025 and 2026: Zero Trust, post-quantum cryptography, logging architecture, and artificial intelligence (AI). Each is treated the same way: what the idea is, what is binding, and how it lands in one system's security plan. The last lesson turns that into a general skill, since the next new requirement is never far away.
None of these topics replaces the Risk Management Framework. Each changes how controls are implemented and what evidence looks like.
Builds on
- Module 7, Lesson 4: current vulnerability and logging requirements.
- Module 8, Lessons 3 and 4: vendor review and software bills of materials, which the cryptographic inventory resembles.
- Module 7, Lesson 3: change and security impact analysis, used here for AI components.
- Module 1, Lesson 2: binding authority and guidance.
Lessons
| # | Lesson | Time | Status |
|---|---|---|---|
| 1 | Zero Trust in Practice | 50 min | New |
| 2 | Post-Quantum Cryptography and the Cryptographic Inventory | 45 min | Adapted; time-sensitive |
| 3 | Logging and Telemetry Architecture | 35 min | Adapted; time-sensitive |
| 4 | Artificial Intelligence in Authorized Systems | 45 min | Adapted; agency detail excluded |
| 5 | Absorbing New Requirements | 30 min | New |
What is binding here, and what is guidance
| Source cited in this module | Kind | Why it has that status |
|---|---|---|
| OMB M-22-09 (Zero Trust strategy) | Binding policy on agencies | OMB direction; status to confirm |
| Executive Order 14412 (June 2026) | Binding on agencies | Presidential direction to executive agencies |
| OMB M-26-15 (June 2026), M-23-02 | Binding policy on agencies | OMB direction on post-quantum migration |
| Quantum Computing Cybersecurity Preparedness Act | Binding statute | Requires agency migration planning |
| FIPS 203, 204, 205 | Binding standards | FIPS are compulsory for agencies under FISMA |
| OMB M-26-14 (logging) | Binding policy on agencies | Rescinds M-21-31 |
| OMB M-25-21, M-25-22 (AI) | Binding policy on agencies | Status to confirm |
| CISA Zero Trust Maturity Model | Guidance | A roadmap; not binding by itself |
| CISA Logging Reference Architecture | Guidance given force by M-26-14 | Agencies must plan against it |
| NIST SP 800-207, 800-92 (Rev. 1 still draft), IR 8547 (final October 2026) | Guidance | Methods and transition planning |
| NIST AI RMF and profiles | Guidance (voluntary framework) | Method for AI risk |
| OWASP list for language model applications | Industry reference | Not federal guidance |
| Agency Zero Trust plan, migration plan, logging plan, AI policy | Binding within the agency | Set your system's targets and dates |
Module summary
- Zero Trust removes trust based on network location. Verify explicitly, use least privilege, assume breach. Rate each of five pillars separately; record gaps against controls you already document.
- Public-key cryptography is threatened by future quantum computers, and harvested data makes the risk current. NIST has published replacement standards. Federal policy issued in June 2026 requires plans, inventories, and phased migration. Start with a cryptographic inventory, including inherited cryptography.
- Logging serves two purposes: detecting now and investigating later. Design for both, close gaps between cloud layers, and write a logging profile that ties each event to a question someone will ask.
- AI components are system components. Check the AI inventory and high-impact determination, limit permissions, treat outside content as untrusted input, log everything, and test.
- For any new requirement: go to the source, read for kind, scope, obligations, dates, and what it replaces, wait for the agency's implementation without waiting idly, translate into controls and dated work, and report.
What comes next
Module 10 is the capstone. You will take a new system from categorization to an authorization recommendation, using everything in Modules 1 to 9.
Last reviewed 2026-11-12. Federal requirements, dates, and web addresses change. Before you rely on a date, deadline, or figure, open the source linked in the lesson.