Vol V Book 04 — Federal Compliance — Vendor Training & Lab Environments
The realization layer — external courses mapped per volume, and scripted fixture / trial-tenant / product-eval lab environments
0.1 Draft Proposal — Subject to Review
This document is a draft proposal developed by the CSI Team (Cloud Services Infrastructure). It has not been reviewed or approved by the Agency CIO Office, the Office of Information Security (OIS), or organizational leadership.
Date Code: 2026-07-18 06:20 ET
Operational appendix — vendor-named by necessity. The rest of Volume V is function-first. This book is the series’ realization layer (Vol 0 Book 00, Theme F: Mechanism, Not Product): one mechanism is realized by N products, each carrying a federal accreditation. A training catalog cannot function without naming the vendors whose products the books deploy, so this book names them — courses, portals, and eval licenses. It assigns no organizational owner and recommends no procurement; it maps existing external training to the volume it supports. Verify every vendor’s FedRAMP / accreditation status on the FedRAMP Marketplace at procurement time.
1 What This Document Addresses
The four preceding Volume V books teach the corpus and grade the learner; none of them teaches a product. This book supplies the two things a learner needs to actually acquire the skills: external vendor training mapped to the volume it supports, and lab environments — scripted, disposable setups where the implementation-track builds can be exercised without a production footprint.
It is a living catalog. As research continues it expands; rows carry the volume they support so the other books can link here stably, and external URLs are re-verified by the repo’s link-check CI so link rot surfaces automatically.
2 How to Use This Catalog
Each implementation module (Vol V Book 02) and each compliance module (Vol V Book 01) points at a section here. Certifications are listed where a role-based cert is the natural packaging; free learning-path options are noted where they exist. “Volumes” columns refer to the volume/book a course supports.
3 Microsoft Role-Based Training
The Compliance reference stack is Microsoft-heavy (Entra, Defender, Sentinel, Purview, SQL Server, Azure networking), so Microsoft Learn role paths cover the largest share of Track B. Microsoft Learn content is free; certification exams are paid.
| Certification / path | Exam | Volumes | Why it maps |
|---|---|---|---|
| Azure Network Engineer Associate | AZ-700 | Vol I Bk 01, 05 | Landing-zone networking, hybrid connectivity, private access |
| Identity and Access Administrator | SC-300 | Vol I Bk 03/04/05 · Vol III Bk 01 | Entra ID, conditional access, PIM, lifecycle — the identity spine |
| Security Operations Analyst | SC-200 | Vol III Bk 02, 06 | Sentinel + Defender XDR detection and Defender VM |
| Information Security Administrator | SC-401 | Vol III Bk 05 · Vol IV Bk 04 | Purview information protection, DLP, insider risk (successor to SC-400) |
| Azure Database Administrator Associate | DP-300 | Vol II Bk 01–03 | SQL Server / Azure SQL administration and authentication modernization |
| Azure Security Engineer Associate | AZ-500 | Vol I Bk 03 · Vol III Bk 05 | Key Vault, CMK, workload identity, platform security controls |
| Cybersecurity Architect Expert | SC-100 | Vol 0 Bk 00 · Vol IV Bk 03 | Whole-of-estate security architecture — the leadership view |
| Microsoft Learn training browser | — | all | Free modular learning paths under every product above |
4 Networking & DDI
| Vendor | Offering | Volumes | Notes |
|---|---|---|---|
| Cisco | Cisco U. | Vol I Bk 02, 05, 07 | SD-WAN (ENSDWI-track), ISE/802.1X NAC, enterprise routing; subscription with free tiers |
| Cisco | Networking Academy | Vol I Bk 02, 05, 06 | Free foundational networking incl. switching/802.1X basics |
| Juniper | Juniper Networks | Vol I Bk 07 | SD-WAN/routing and Mist Access Assurance NAC where Juniper gear is in scope |
| Infoblox | Infoblox Education | Vol I Bk 01 | DDI (IPAM/DNS/DHCP) training for the reference stack — role-based courses + free Launchpad |
| BlueCat | BlueCat Training | Vol I Bk 01 | DDI learning paths for the BlueCat migration path covered by the reference implementation’s adapter |
| CompTIA | CompTIA (Network+, Security+) | Vol 0–I | Vendor-neutral baseline for staff entering without a networking background |
5 Identity & Zero Trust
| Vendor | Offering | Volumes | Notes |
|---|---|---|---|
| Microsoft | SC-300 / AZ-500 (see §Microsoft) | Vol I Bk 03/04/05 · Vol III Bk 01 | Primary identity stack incl. the credential plane and lifecycle provisioning |
| SailPoint | Identity University | Vol I Bk 04 · Vol III Bk 01 | Joiner-mover-leaver governance for the HRIT lifecycle; NERM boundary exception documented in Vol III Bk 01 |
| Fortinet | Fortinet Training Institute | Vol I Bk 05, 06 | Free NSE-track courses; SASE/ZTNA modules |
| Palo Alto Networks | Education services | Vol I Bk 05, 06, 07 | SASE (Prisma-track) coursework where Palo Alto is the SASE vendor |
| Zscaler | Zscaler Cyber Academy | Vol I Bk 05, 06 | ZDTA/ZTCA-track SASE and zero-trust; separate Government Academy for federal |
| Netskope | Netskope Training | Vol I Bk 05, 06 | Netskope One administrator/professional and SASE accreditation |
6 Data Platform
| Vendor | Offering | Volumes | Notes |
|---|---|---|---|
| Microsoft | DP-300 + SQL learning paths (see §Microsoft) | Vol II Bk 01–03 | Authentication modernization, managed instance patterns, HA/DR for consolidation |
7 Security Operations
| Vendor | Offering | Volumes | Notes |
|---|---|---|---|
| Microsoft | SC-200 (see §Microsoft) | Vol III Bk 02, 06 | Sentinel + Defender — the reference SIEM/XDR |
| Splunk | Splunk training | Vol III Bk 06 | Portable SIEM/detection fundamentals for mixed SIEM estates |
| Elastic | Elastic training | Vol III Bk 06 | Detection-engineering concepts transfer; same rationale as Splunk |
| SANS | SANS course catalog | Vol III Bk 01, 02, 06 · Vol IV Bk 05 | Instructor-led depth (detection, vuln mgmt, privileged access); GIAC-certifiable |
| ISC2 | ISC2 certifications | Vol 0 Bk 00 · Vol IV Bk 03 | CISSP/CGRC-track governance framing for program leads |
| Tenable | Tenable education | Vol III Bk 02 | Nessus / Tenable VM — alternative vuln-management stack |
| Qualys | Qualys training | Vol III Bk 02 | Free certified courses with labs (VMDR, CSAM) — alternative-stack rationale |
8 Federal & Compliance
| Source | Offering | Volumes | Notes |
|---|---|---|---|
| CISA | CISA Learning | Vol III Bk 02, 06 · Vol IV Bk 01, 05 | Free federal cyber training (successor to FedVTE) — IR, vuln mgmt, continuity |
| CISA | Training resources index | Vol III Bk 02, 06 · Vol IV Bk 01, 02 | KEV-driven vulnerability response and SCuBA-adjacent material |
| FedRAMP PMO | fedramp.gov | Vol 0 Bk 00 · Vol IV Bk 02, 03, 06 | 20x program docs, KSI definitions, submission process — the Track A authority |
| NIST | NICE Workforce Framework | Vol IV Bk 03, 05 | Role/competency framework — maps program roles to workforce categories |
| AWS | AWS Skill Builder | Vol I Bk 06 | Amazon Connect training for the N8NN contact-center boundary exception |
| OpenSSF | OpenSSF training | Vol IV Bk 02 | Developing Secure Software (LFD121) — supply-chain fundamentals for the SBOM pipeline |
| Linux Foundation | Automating Supply Chain Security: SBOMs and Signatures (LFEL1007) | Vol IV Bk 02 | Matches the Syft/SBOM/signing pipeline (CycloneDX, attestation, signing) |
| ISACA | ISACA credentialing | Vol IV Bk 03 | CISM / CRISC governance and risk tracks for PM-governance roles |
| IAPP | IAPP certification | Vol IV Bk 04 | CIPP/US and CIPM privacy training for the PT-family work |
| ServiceNow | ServiceNow University | Vol III Bk 06 · Vol IV Bk 03 | ITSM/CMDB training — the incident-ticket and evidence-workflow side; the reference implementation ships a ServiceNow adapter |
9 Lab Environments
Each Track B module ends with labs; the environments below stand up what those labs need. Scripts are embedded in the manuscripts — this is documentation source, not a runnable tree; copy the blocks into your own shell/tenant.
9.1 Lab Tiers
| Tier | What it needs | Use when |
|---|---|---|
| Tier F — fixture | Nothing but this repo and Python | You want the evidence-binding mechanics (slot YAML → <engine> oscal ksi-ar) with no cloud footprint |
| Tier T — trial tenant | A Microsoft 365 developer/trial tenant + Azure trial | The access/identity, PIM, Sentinel, and Purview labs — full behavior, disposable blast radius |
| Tier P — product eval | A vendor eval (Infoblox/BlueCat) or containerized DNS/DHCP | The DDI lab’s split-horizon and provisioning exercises |
9.2 Safety Rules (Read Before Any Lab)
- Never a production tenant. Every lab assumes a disposable tenant or subscription you can delete. PIM changes, CA policies, and DLP enforcement are exactly the things that lock organizations out.
- Report-only first. Where a lab creates a Conditional Access or DLP policy, it is created in report-only/simulation mode — the discipline Vol III Books 01 and 05 mandate for production.
- Break-glass before lockdown. The PIM lab creates its excluded emergency account first, mirroring Vol III Book 01’s ordering.
- Teardown is part of the lab. Each lab ends with a teardown block; run it. Orphaned trial resources are how “labs” become shadow IT.
9.3 Lab Environment Setups
| Lab | Module | Stack | Tier |
|---|---|---|---|
| DDI (Vol I Bk 01) | B1 | Infoblox eval or BIND/Kea containers + IPAM fixture | P / F |
| Access & identity (Vol I Bk 02–04) | B2 | NPS/RADIUS + Intune SCEP; lab CA + ACME DNS-01; SCIM shadow-mode | T / F |
| Data platform (Vol II Bk 01–03) | B4 | SQL Server 2022 container or Azure SQL trial + Entra-integrated auth | T / F |
| PIM & privileged access (Vol III Bk 01) | B5 | Entra ID P2, Intune, Graph PowerShell | T |
| Sentinel detection (Vol III Bk 02/06) | B6 | Log Analytics + Sentinel, one forwarder VM | T |
| Purview data protection (Vol III Bk 05) | B6 | Purview labels/DLP, Key Vault Premium | T |
Modules B3 (network/telecom SD-WAN/SASE), B7 (resilience/governance), and B8 (authorize & operate) intentionally have no tenant lab: B3 needs vendor SD-WAN gear or eval licenses (track via the vendor tables above), while B7 and B8 are document- and CI-shaped (SBOM workflow on any repo, tabletop exercise, OSCAL bundle generation, training-record JSON validation) — they run anywhere, Tier F.
9.4 The Common Final Step — Bind the Evidence
Every lab ends the same way, regardless of tier: place the produced artifact where a slot mapping can reference it, then regenerate verdicts:
<engine> oscal ksi-ar --output exports/oscal/ksi-ar.jsonThe Vol V Book 03 rubrics score what you produce.
10 Cost Notes
- M365 E5 developer/trial tenants cover Entra ID P2 (PIM), Purview, and Defender features for the trial window.
- Sentinel bills per GB ingested — the lab keeps ingestion in the free-tier range by using a single VM/forwarder and seeded events.
- Infoblox/BlueCat evals are vendor-arranged; the Tier-F fixture path needs no license.
11 Research Queue
Candidates identified but not yet verified — next expansion pass:
- Instructor-led Compliance cohort design — whether any vendor offers application-aware-networking-specific curriculum worth licensing, vs. composing from the product training above.
- Zscaler Government Academy — the federal-specific variant vs. the commercial Cyber Academy for GCC boundary relevance.
- CDM program training — DHS/CISA Continuous Diagnostics and Mitigation training for the Vol III Book 02 KEV-upload workflow.
- Security-awareness platforms (KnowBe4, Proofpoint) — Vol IV Book 05 names them in its delivery trade-space; verify their academy portals and GCC suitability before adding rows.
12 Series Context — Vol V Book 04
This book is the realization layer of Volume V and the one place the volume names vendors — deliberately, as Theme F prescribes: one mechanism, N accredited products. It supplies the external training the implementation track (Vol V Book 02) points to for product skill, and the lab environments where that track’s builds are exercised and their evidence produced. The artifacts the labs generate are bound per the common final step and scored against Vol V Book 03’s rubrics. Kept function-first everywhere else, the series confines its vendor surface here — so the doctrine of Books 00–03 stays clean while the learner still gets a concrete, buyable path to the skills.
Federal Compliance — Vol V Book 04 of the series. Volume V is the enablement layer; this book is its realization layer — external vendor training mapped per volume and the scripted lab environments for the implementation track. Vendor names appear here by necessity (Theme F, Mechanism Not Product) and imply no endorsement or procurement decision; verify FedRAMP / federal accreditation status at procurement time. This is companion training material, self-assessed and advisory, pending independent review.