Requirements for Certification under the Grandfathering Provision To support the growing demand for skilled security professionals with the knowledge and background to support the Federal governments mandate to ensure appropriate levels of security for every information system placed into operation the FISMA Center is offering a new certification: Certified FISMA Compliance Practitioner (CFCP). Until 31 December 2009, highly experienced professionals who have had a significant role in designing, refining, and/or implementing a FISMA compliance program, can apply for certification as a CFCP without being required to pass the CFCP examination. All CFCP certification holders shall abide by the CFCP Code of Ethics: 1. Act responsibly and ethically, in accordance with applicable laws and guidance 2. Promote the information security discipline 3. Share knowledge with those inside and outside of information security 4. Strive to advance information security personally and professionally 5. Avoid potential and actual conflicts of interest 6. Avoid compromising the reputation and standing of the information security field 7. Protect IT assets, systems, networks and information to the highest professional ethical standards 8. Advocate compliance with all Federal information security legislation and mandates 9. Refrain from intentionally maligning or damaging the reputation of peers, colleagues or employers 10. Use sound and informed judgment when dealing with sensitive personally identifiable information (PII), Privacy Act data, and financial data Continuing Professional Education (CPE) Credits: All individuals who become certified will be required to obtain 20 CPE credits annually in a training class or classes that are related to information security. The classes do not have to FISMA Center classes. No CPE credits will be required in the first calendar year that you receive the certification. To earn the CFCP designation during this period, applicants are required to: 1. Submit evidence of appropriate work experience in the form of a resume. 2. Provide points of contact which can verify the accuracy of the submitted resume. 3. Remit payment for the application fee along with the application. Copyright 2009 by FISMA Center p. 1/7
1. Work Experience In order to qualify for the CFCP certification under the grandfathering provision an applicant must provide evidence of experience associated with the design, refinement, and/or implementation of a FISMA compliance program. The applicant has at least three (3) years of combined, non-overlapping experience in one or more of the following areas: Executing security controls assessments on federal information systems and documenting risks. Within this area the applicant must be able to show they have performed the following tasks: - Performed risk assessments - Conducted assessments of the effectiveness of security controls - Analyzed and documented operational risk for information technology systems Providing recommendations regarding how FISMA-compliant security controls can be effectively implemented in an information system and documenting security control implementations. Within this area the applicant must be able to show they have performed the following tasks: - Documented the security posture of an information system in a System Security Plan, Security Assessment Report, Risk Assessment or similar document - Participated in the design and architecture of an information system providing security inputs The applicant has at least one (1) year of experience providing guidance to senior management on how to operate and/or maintain a FISMA-compliant risk management framework. 2. Points of contact In order to evaluate the applicant s work experience, a copy of the applicant s current resume must be attached and submitted with the application. Additionally, the applicant must provide points of contact for three different employers so that the FISMA Center can verify the work experience depicted in the resume. If the applicant has not held jobs with three different employers, then three different points of contact related to a single employer can be used. The points of contact provided must: 1. Be individuals who supervised the applicant s work, OR 2. Be clients who the applicant served Each contact must have their current role, and the role at the time you worked with/for them indicated in the contact information part of the form. Copyright 2009 by FISMA Center p. 2/7
3. application fees Application Fee: In order to process the application under the grandfathering provision the applicant must remit payment with the application. The application will not be reviewed until full payment is received. Please go to http://www.fismacenter.com and click on the link in the CFCP section of our website to submit your non-refundable $125.00 application fee. In extenuating circumstances, a check is accepted. Please email info@fismacenter.com to inquire. Certificate Fee: If your application is approved, there will be an additional certificate fee of $349.00. Please go to http://www.fismacenter.com and click on the link in the CFCP section of our website to submit your certification fee. To be officially certified and receive your CFCP certificate and number, we must first receive your certificate fee. Instructions for Submission: Please submit the application on the following page filled out completely along with a current copy of your resume/cv, and photocopy of a picture ID to: FISMA Center 10440 Little Patuxent Parkway Columbia, MD 21044 Alternatively, you can scan in the application and email it to cfcp@fismacenter.com. We do not accept faxed applications. Make sure your resume is detailed. If your resume is missing key information, this could hold up the processing of your application. If you have developed any documents related to FISMA, please indicate whether you are the sole author or you are a co-author. You should receive an email indicating receipt of your application within 10 business days from the date it is received. If you submit your application by email there is a strong chance that it will be processed faster. After that, please allow up to 8 weeks for your application to be processed including verification of your credentials with the points of contact you ve provided. Copyright 2009 by FISMA Center p. 3/7
Application Form CFCP Certification under the Grandfathering Provision applicant s contact Information Name Address ( ) / ( ) Telephone (1) / Telephone (2) citizenship: U.S. Citizen Other certifications: Please list any other cerifications you hold below By signing below, you agree if approved, to abide by the CFCP Code of Ethics. Applicant s Signature date for office use only approved Date Received CFCP # date Approved not approved Reason Copyright 2009 by FISMA Center p. 4/7
- Points of Contact applicant s contact Information Name (Last, First MI) date of Application Telephone Point of Contact for Employer or Project 1 Supervisor Name title employer Telephone For office use only Copyright 2009 by FISMA Center p. 5/7
- Points of Contact Point of Contact for Employer or Project 2 Supervisor Name title employer Telephone For office use only Copyright 2009 by FISMA Center p. 6/7
- Points of Contact Point of Contact for Employer or Project 3 Supervisor Name title employer Telephone For office use only Copyright 2009 by FISMA Center p. 7/7