Module 0 IT Fundamentals
Already know this? Pass the diagnostic pre-test (14 questions, 80 percent) to complete this module and unlock the next.
What you will be able to do
- Describe how hardware, operating systems, virtual machines, and containers relate.
- Read a simple network diagram and explain addressing, name resolution, common ports, firewalls, and virtual private networks.
- Distinguish authentication from authorization and explain multifactor authentication and directory services.
- Explain the cloud service models and who is responsible for what in each.
- Define confidentiality, integrity, and availability, and explain symmetric encryption, asymmetric encryption, and hashing at a conceptual level.
- Read the everyday working documents of security - diagrams, tickets, trackers, logs, and scan reports.
- Explain why government IT treats documentation as a security control.
Lessons
The lessons, exercise, and quiz are for registered learners. Create a free account or sign in to read them.
- 1. Computing Basics · 35 min Completed
- 2. Networking Fundamentals · 50 min Completed
- 3. Identity and Access Basics · 40 min Completed
- 4. Cloud Computing Basics · 35 min Completed
- 5. Security Fundamentals · 50 min Completed
- 6. Documentation and Tooling Literacy · 40 min Completed
- 7. How Government IT Differs from the Private Sector · 30 min Completed
Practice and quiz
- Practical exercise: Annotate the CivicCRM Architecture
- Module quiz (14 questions, pass mark 80 percent)
Overview
This module is the on-ramp. The rest of the course teaches how federal systems are categorized, documented, assessed, and authorized, and it assumes you already know what a server, a subnet, a service account, and an encryption key are. If you do, take the diagnostic and skip ahead. If you do not, this module teaches exactly the concepts the later modules rely on, and no more.
You will not learn to administer systems here. You will learn to recognize the parts of one, read the documents that describe it, and ask useful questions. That is the technical fluency an Information System Security Officer (ISSO) needs on day one.
Who can skip this module
Take the diagnostic pre-test (14 questions, about 15 minutes). Score 80% or higher (12 of 14) and Module 1 unlocks immediately. You can still read any lesson afterward.
How the module works
Seven lessons, each with the same shape: why it matters, core content, a worked example, common mistakes, and a short self-check. Every worked example uses CivicCRM, a small fictional system a federal office uses to schedule public events and answer non-sensitive public inquiries. You will see it, and two larger fictional systems, throughout the course.
| # | Lesson | Time |
|---|---|---|
| 1 | Computing Basics | 35 min |
| 2 | Networking Fundamentals | 50 min |
| 3 | Identity and Access Basics | 40 min |
| 4 | Cloud Computing Basics | 35 min |
| 5 | Security Fundamentals | 50 min |
| 6 | Documentation and Tooling Literacy | 40 min |
| 7 | How Government IT Differs from the Private Sector | 30 min |
After the lessons, complete the practical exercise and pass the module quiz (80%) to unlock Module 1.
What is binding here, and what is guidance
Every module ends with this table. Learning to tell the two apart is one of the most useful habits in federal security.
| Source cited in this module | Kind | Why it has that status |
|---|---|---|
| Federal Information Security Modernization Act (FISMA) | Binding statute | Passed by Congress |
| OMB Circular A-130 | Binding policy | Issued by the Office of Management and Budget to agencies |
| FIPS 199, FIPS 200 (categorization; minimum requirements) | Binding standards | Federal Information Processing Standards are mandatory for federal agencies |
| FIPS 140-3, FIPS 197, FIPS 180-4, FIPS 201-3 (cryptographic modules, AES, hashing, PIV cards) | Binding standards | As above |
| Federal Acquisition Regulation | Binding regulation | Governs federal purchasing |
| NIST SP 800-145 (cloud definition) | Guidance | Special Publications are guidance unless a law, policy, or standard makes them required |
| NIST SP 800-63-4 (digital identity) | Guidance | As above. Agencies are generally directed to follow it by policy; the specifics are covered in later modules |
| NIST SP 800-37, 800-41, 800-81, 800-83, 800-92, 800-125, 800-175B, 800-190 | Guidance | As above |
| STIGs and CIS Benchmarks | Guidance | Become required where an agency's policy adopts them |
| CVE, CVSS, IANA port registry, RFC 1918 | Reference | Industry references, not federal requirements |
Module summary
- A system is a stack of components, some physical, some virtual, some run by someone else. List all of them.
- Networks are read through addresses, ports, and rules.
0.0.0.0/0means everyone. - Authentication proves identity; authorization grants permission. Review both, for people and for software.
- In the cloud, the question is always who does what. Access, configuration, and data remain the customer's job.
- Security protects confidentiality, integrity, and availability by reducing risk to an acceptable level, never to zero.
- The ISSO's raw materials are diagrams, tickets, trackers, logs, and scan reports. The skill is comparing them to what was approved.
- Federal security is required by law, checked independently, and decided by a named official on written evidence. That is why the paperwork matters.
What comes next
Module 1, The Federal Security Landscape, takes Lesson 7 and expands it: the law, the roles, and how an obligation travels from statute to a single setting on a single system.
Last reviewed 2026-11-11. Federal requirements, dates, and web addresses change. Before you rely on a date, deadline, or figure, open the source linked in the lesson.