Federal Compliance Series - Moderate — Volume V: Training & Certification
Volume purpose — the enablement layer that teaches Volumes 0–IV and evidences the training slot
Draft posture
This document is a draft proposal. It has not been reviewed or approved by the agency CIO Office, the Office of Information Security, or organizational leadership.
Volume purpose
Volume V is where the series becomes a workforce. Volumes 0–IV describe the naming and identity substrate, the data platform, the security-operations planes, and the governance and authorization machinery. None of that closes a control until someone can build the mechanism, land its evidence, and trace it from the book that specifies it, through the NIST SP 800-53 control it satisfies, to the FedRAMP 20x Key Security Indicator that scores it. Volume V builds that competency — and, in doing so, operationalizes the training program that produces the training-effectiveness record: proof that the people running the program are trained.
The volume is organized as two tracks over the same corpus. A compliance track reads the series as control-closure evidence — one module per evidence slot, book → control → Key Security Indicator → evidence. An implementation track reads it as build instructions — one module per book cluster, each ending by landing an evidence artifact. The volume’s governing claim is that conformance tooling measures drift from an intended state; it cannot author one. A workforce, not a scanner, authors the evidence state — and that competency is itself a control.
Books in this volume
| Book | Title | Role |
|---|---|---|
| Book 01 | The Compliance Track | The evidence slots taught as curriculum |
| Book 02 | The Implementation Track | Building the architectures and landing the evidence |
| Book 03 | Assessment, Rubrics & Certification | Rubric ladder and certification exam |
| Book 04 | Vendor Training & Lab Environments | External courses mapped per volume and scripted lab environments |
Relationship to Volume IV Book 05
Volume IV Book 05 specifies the awareness and training family program and its control closure. This volume is the academy that operationalizes that program — the two tracks, labs, and certification — and produces the training-effectiveness record. The division is deliberate: Volume IV Book 05 states what the program must be and close; Volume V teaches it, runs the labs, and certifies competency.
How this volume fits the program
Volume V depends on every architecture volume it teaches. It produces two things the program depends on: trained operators and assessors, and the training-effectiveness record that the authorization package freezes into the structured bundle. Remove Volume V and Volumes I–IV survive as documents, but the path from “the books exist” to “the workforce closes the controls and the training Key Security Indicator evaluates” does not.
Where evidence lands
The binding of this volume’s closures and evidence to a governance substrate is optional and separable. The volume stands complete at FedRAMP Moderate with no substrate engagement at all. Adopting a substrate adds machine-checked scoring and drift-gating on top of what is already closed, and can be adopted later — or never — without rework.
Cleaned extraction for project use. No internal branding or document identifiers.