CCEP® Certified Compliance & Ethics Professional

Understand principles of information security and risk management frameworks (NIST, COBIT, ISO 27001, etc.).

Learn the System Development Life Cycle (SDLC) and information system boundary requirements.

Implement security controls and define roles in the authorization process.

Identify and document baseline and inherited controls.

Select, tailor, and document appropriate controls and control enhancements.

Develop a continuous monitoring strategy and approve security plans.

Implement mandatory configuration settings according to industry standards (NIST, GDPR, etc.).

Ensure implementation consistency with organizational security and privacy architecture.

Coordinate implementation of inherited and compensating controls.

Prepare for and conduct assessments/audits, collecting relevant evidence.

Validate control implementation and compliance using approved methods.

Analyze audit results, identify vulnerabilities, and propose remediation actions.

Compile required security and privacy documentation for authorization.

Evaluate information system risks and determine risk treatment options.

Authorize or approve the information system, addressing residual risks.

Monitor changes to the information system, assess risks, and implement changes.

Conduct ongoing assessments, monitor vulnerabilities, and review supply chain risks.

Update risk posture and decommission systems when necessary.