Compliance Training Program
Two-track curriculum over the 20 core books (Book 00-19) of the Federal Compliance series — compliance and implementation
This is the Compliance Training Program — the two-track curriculum over the Federal Compliance book series. The host site also publishes a separate engine Academy — the governance engine’s own contributor/operator curriculum. Within Compliance, Vol V of the series is this program’s narrative layer; the pages here are the courseware.
The Compliance book series and this training program are companion material for the federal vertical — they are not part of the governance engine. The reference implementation’s core is vertical-agnostic; the Compliance corpus is external federal-modernization content that the reference implementation’s conformance tooling happens to consume as evidence. Nothing on these pages is host-repo canon, defines engine doctrine, or is scoped for a FMP_NNN allocation. These pages are hosted here for convenience alongside the adapter that binds the books’ evidence.
This program is a research-driven living curriculum. It launches with the program charter, the two track outlines, and a first-pass vendor training catalog. As research continues, modules gain per-book lesson pages, labs, assessment rubrics, and additional vendor offerings. See Expansion roadmap.
What this program is
The Federal Compliance series spans eleven volumes; this training program covers its 20 core books (Book 00 through Book 19) that document a complete federal network modernization: landing zone and IPAM, network access control, cryptographic identity, the HR-driven identity and organizational SSOT, network and telecommunications modernization, data-platform authentication, privileged access, vulnerability management, data protection, detection engineering, business continuity, supply-chain risk, program governance, PII transparency, cybersecurity training, and the authorization package / ConMon wrapper. The books live on the published site at [docs/customer-documents/federal-compliance-series/] and are bound to FedRAMP 20x evidence slots by the [fedramp_aan_catalog adapter].
The Compliance Training Program teaches that corpus in two tracks:
| Track | Page | Audience | Outcome |
|---|---|---|---|
| Track A — Compliance | Compliance track | ISSOs / ISSMs, assessors, ConMon operators, compliance leads | Can state, for each of the 20 books, which NIST SP 800-53 Rev 5 controls it closes, which FedRAMP 20x KSI category evaluates that closure, and how the evidence flows through the engine’s conformance pipeline |
| Track B — Implementation | Implementation track | Network, platform, database, identity, and security engineers | Can implement the architecture each book describes and produce the machine-readable evidence Track A consumes |
A third page, the Vendor training catalog, maps each book to existing external training from the vendors whose products the books deploy (Microsoft, Infoblox, Cisco, AWS, and others), plus federal/compliance training sources (CISA, FedRAMP, NIST).
Relationship to governance engines
- This program is separate from the reference implementation’s own training program (Contributor + Operator tracks). That program teaches the reference implementation; this program teaches the Compliance book series, which is not the governance engine material. The only connection is mechanical: the
fedramp_aan_catalogconformance adapter reads the books’ artifacts as evidence, the same way the engine’s adapters read any external vendor’s output. - The engine core is vertical-agnostic. Describing this curriculum as part of any governance engine would itself be a positioning bug.
- The compliance backbone follows the [Compliance / ConMon Compliance Gap Roadmap] and the slot bindings in [
fedramp_aan_catalog/mappings/].
The Compliance books are published under docs/customer-documents/federal-compliance-series/. They are external companion material, not host-repo canon, and are not on a canonization path. If the books move to their own home, the links below follow them. Treat control-closure counts as working figures from the gap roadmap, not attested facts.
The 20-book corpus
Each book now has a module page — objectives, key concepts, implementation sequence, compliance hooks, labs, pitfalls, and vendor training pointers, all derived from the book’s actual content. The module page links to the canonical manuscript source.
| Book | Module page | Domain | Evidence slot(s) | KSI category |
|---|---|---|---|---|
| 00 | Executive Summary | Orientation | — | — |
| 01 | Cloud Landing Zone, IPAM & FedRAMP | DDI / IPAM landing zone | 2 — addressing | KSI-PIY |
| 02 | Network Access Control (802.1X) | Device identity at the port | (binding pending mapping refresh) | KSI-CMT / KSI-IAM themes |
| 03 | Certificates, Tokens & Cryptographic Identity | PKI, tokens, phishing-resistant MFA | 1 — identity | KSI-IAM |
| 04 | HRIT Identity & Org SSOT | HR-driven identity lifecycle | 1 — identity | KSI-IAM |
| 05 | Network Modernization | SD-WAN, SASE, UC | 3 — network | KSI-CNA |
| 06 | Federal Telecommunications Modernization | Entra ID, ZTNA, cloud voice | 1 — identity | KSI-IAM |
| 07 | SQL Server Authentication Modernization | Data-platform identity | 1 — identity | KSI-IAM |
| 08 | SQL Server Implementation Guide | Data-platform runbook | (procedural evidence for Book 07) | — |
| 09 | Database Consolidation & Network Physics | Database architecture | 3 — network | KSI-CNA |
| 10 | Privileged Access Management | Entra PIM + PAW | 1 — identity; 5 — endpoint | KSI-IAM, KSI-PIY |
| 11 | Vulnerability Management | Defender VM + KEV | 4 — telemetry; 5 — endpoint; 6 — security | KSI-MLA, KSI-PIY, KSI-CMT |
| 12 | Data Protection (Purview) | Purview + Key Vault CMK | 4 — telemetry | KSI-MLA |
| 13 | SIEM / XDR Detection | Sentinel detection engineering | 4 — telemetry; 6 — security | KSI-MLA, KSI-CMT |
| 14 | Business Continuity | Contingency planning | 7 — continuity | KSI-RPL |
| 15 | Supply Chain Risk Management | SBOM, VDR/VER, BOD 26-04 | 6 — security | KSI-CMT |
| 16 | Program Management & Governance | PM charter | 6 — security | KSI-CMT |
| 17 | PII Processing & Transparency | PT control family | 5 — endpoint | KSI-PIY |
| 18 | Cybersecurity Training & Awareness | AT control family, LMS evidence | 8 — training | KSI-CED |
| 19 | Authorization Package & ConMon | OSCAL AP/AR/POA&M, CA family | (assembles all eight slots) | — |
Slot definitions, KSI categories, and NIST anchors come from the adapter’s [mapping files] — the same data the conformance pipeline evaluates, so the curriculum cannot silently drift from the evidence model.
The adapter’s mapping files still reference the pre-restructure numbering and filenames and are pending refresh for the 20-book series; the slot column above uses the books’ own stated bindings (Books 03/04 → slot 1) plus the prior bindings translated to the new numbering.
Program structure
- Orientation (both tracks) — read Book 00 and the [gap roadmap]; understand the FedRAMP 20x timeline (Class A opens August 3, 2026; 20x mandatory January 2027; BOD 26-04 VDR/VER due December 7, 2026).
- Pick a track — Track A Compliance or Track B Implementation. The tracks share the corpus but read it differently: Track A reads books as control-closure evidence; Track B reads them as build instructions.
- Supplement with vendor training — each module points into the vendor training catalog for the underlying product skills (Entra, Sentinel, Purview, Infoblox DDI, SD-WAN, …).
- Capstone (both tracks) — produce or evaluate a KSI evidence bundle with the engine CLI (
<engine> ksi evaluate,<engine> oscal ksi-ar,<engine> oscal generate) against the eight Compliance evidence slots.
The Core Compliance Pathway
The full program walks all 20 books; most ISSOs and engineers should start with the nine-book spine below, which feeds six of the eight evidence slots directly and exercises both capstone surfaces:
| Book | Module page | Why it is in the spine | Slot(s) fed |
|---|---|---|---|
| 00 | Executive Summary | The argument and the deadline map | — (orientation) |
| 01 | Cloud Landing Zone, IPAM & FedRAMP | Addressing is the dependency everything else assumes | 2 |
| 03 | Certificates, Tokens & Cryptographic Identity | The credential plane | 1 |
| 04 | HRIT Identity & Org SSOT | The lifecycle source of truth | 1 |
| 05 | Network Modernization | The application-aware transport argument | 3 |
| 10 | Privileged Access Management | The highest-blast-radius identity surface | 1, 5 |
| 11 | Vulnerability Management | The KEV-driven telemetry spine | 4, 5, 6 |
| 13 | SIEM / XDR Detection | Detection engineering closes the telemetry loop | 4, 6 |
| 19 | Authorization Package & ConMon | Assembles everything into the package | (assembles all) |
Pair the spine with the four scripted labs (DDI, PIM, Sentinel, Purview).
The pathway is a starting sequence, not a credential path: slots 7 (continuity — Book 14) and 8 (training — Book 18), the supply-chain depth of Book 15, and the full capstones still come from the complete tracks, and the Track A pass bar remains all eight slots. Read the spine, run the labs, then finish the track you belong to.
The <engine> token — what the commands run
Every command block in this program writes <engine> where a CLI name would go. It is a substitution token, not a product: the program is engine-neutral, and the commands are defined by the [Compliance Evidence & Authorization Contract] — the open specification (compliance spine + eight evidence slots + OSCAL AP/AR/POA&M boundary) that any conformant evidence engine can satisfy. Substitute the CLI name of whichever conformant engine your agency runs.
The three commands the capstones need:
| Command | What it does | What you get |
|---|---|---|
<engine> ksi evaluate --ir <file> --out <file> |
Evaluates a machine-readable evidence (IR) file against the KSI rules | Per-rule verdicts (the raw scoring pass) |
<engine> oscal ksi-ar --output <file> |
Builds Assessment Results from the eight Compliance slot evidence bindings | Per-KSI satisfied / not-satisfied / not-evaluated verdicts — the artifact both capstones require |
<engine> oscal generate |
Generates the OSCAL package documents from an evidence bundle | SSP / POA&M material for the Book 19 assembly |
What Tier F actually runs: the host repository that publishes these pages ships a reference engine satisfying the contract, alongside the [slot mapping files] the curriculum is derived from. The fixture path is: clone the repository, install the reference engine per its README, substitute its CLI name for <engine>, and run the three commands above — no cloud footprint required (see the lab tiers).
Completion criteria
Borrowing the pattern of the reference implementation’s training program (no parallel certification system), without being part of that program:
- Track A — a clean walk of all eight slot mappings: for each slot, name the books that feed it, the KSI category that evaluates it, and produce a
<engine> oscal ksi-arrun showing each KSI verdict (satisfied / not-satisfied / not-evaluated), with a short written gap statement for anything not yet evaluable. - Track B — implement (or lab-simulate) one module end-to-end and land its evidence artifact where the slot mappings can bind it, verified by regenerating the KSI Assessment Results (
<engine> oscal ksi-ar) and seeing the slot’s verdict reflect the new evidence.
Expansion roadmap
Planned growth as research continues (tracked in ordinary PRs against this directory):
- ✅ Per-book module pages — shipped: all 20 books have module pages (see the table above) with objectives, key concepts, implementation sequence, labs, and pitfalls derived from the manuscripts. Next iteration: reading checkpoints and quiz items.
- ✅ Vendor catalog verification — first research pass complete: the original research-queue vendors (Zscaler, Netskope, ServiceNow, Linux Foundation/OpenSSF, ISACA, IAPP, Tenable, Qualys) are now catalog rows with verified training-portal URLs.
- ✅ Lab environments — shipped: the lab hub with scripted setups for DDI (B1), PIM (B5), Sentinel (B6), and Purview (B6), tiered fixture / trial-tenant / product-eval. Next iteration: B2 access/identity and B3 SD-WAN eval-gear labs.
- ✅ Assessment rubrics — shipped: per-slot scoring sheets for the Track A capstone with a four-level scale and explicit pass bar.
- ✅ Corpus sync (July 2026) — Books 18 (Training & Awareness) and 19 (Authorization Package & ConMon) joined the corpus; slot 8 — training (KSI-CED) joined the evidence model, taking the series’ internal 29-rule KSI decomposition to fully evaluable. Module pages, tracks, rubrics, and figures updated.
- ✅ Series restructure sync (July 2026) — resynced to the 20-book Compliance series: three new early books (02 Network Access Control, 03 Certificates/Tokens, 04 HRIT Identity & Org SSOT), all downstream books renumbered (+3), filenames moved to the
Compliance_scheme, module pages/tracks/figures/rubrics/bundle regenerated. - ✅ External-evaluation response (July 2026) — the program was independently reviewed (see the evaluation and its graded assessment in the series directory); this wave shipped the graded response: the Core Compliance Pathway, the
<engine>tooling note, the PIM lab’s bind-the-evidence close, boundary-context cross-links from Books 05/06/11/12/13, the post-implementation KPIs, and stable Date Codes replacing render-time dates on every page. - A permanent home — this material is not the governance engine’s and will not be canonized as a
FMP_NNNspec; if the Compliance corpus moves to its own repo/product, the program moves with it.
Next
- Compliance staff → Track A — Compliance track, scored by the assessment rubrics
- Engineers → Track B — Implementation track, with lab environments
- Everyone → Vendor training catalog