Assessor & RMF/ATO

For people who assess controls, assemble authorization packages and support authorization to operate (ATO) decisions: security control assessors, RMF analysts and IT auditors. It is built by practitioners who prepare defense contractors for CMMC and NIST SP 800-171 assessments.

The track at a glance

Stage 1 — Assessment Practice: NIST SP 800-53A & 800-171A

Assessment methods (examine, interview, test), sampling and evidence quality, writing findings, and reviewing System Security Plans and POA&Ms, with CMMC assessment parallels throughout.

Stage 2 — RMF & ATO in Practice

The Risk Management Framework (NIST SP 800-37): categorization, control selection and tailoring, assessment, authorization packages, continuous monitoring and ongoing authorization.

Stage 3 — ISC2 CGRC Prep

Preparation across the CGRC domains. For the advanced assessor level, pair the track with the accredited ISACA CISA cohort from VIS, priced separately.

DoD 8140 alignment

The certifications this track prepares for appear in the DoD 8140 qualification matrix as foundational qualification options for these DCWF work roles:

Based on the DoD 8140 qualification matrix (version 2.1, effective 19 September 2025). The proficiency level a certification satisfies differs by work role, and your contract sets what applies, so we confirm it person by person in a Workforce Readiness Assessment. A certification covers foundational qualification only; resident (on-the-job) qualification and at least 20 hours a year of continuous professional development can also apply.

Roles you’ll be ready for

Security Control Assessor, RMF/ATO analyst and IT Program Auditor.

Frequently asked questions

Who is this track for?

Security control assessors, RMF and ATO analysts, IT auditors, and compliance staff who prepare assessment evidence.

Is this official ISC2 training?

No. VIS builds and teaches its own exam-preparation material and is not an ISC2 training partner. Exam vouchers are bought separately from ISC2. The CISA option is delivered by VIS as an accredited ISACA Training Organization.

Do I need experience for CGRC?

CGRC requires two years of cumulative paid work experience in one or more of its seven domains. If you pass without it, you become an Associate of ISC2 while you build the experience.

How is it delivered?

Live-virtual, instructor-led cohorts. Cohorts run once minimum enrollment is met; next dates announced soon.