• 12 chapters

    10 requirements, plus an Overview and Wrap-Up

  • 62 short lessons

    Understand, implement, then assess and prove

  • 28 videos

    Narrated, 3 to 5 minutes each

  • About 2.5 minutes

    Self-paced, with 12 months of access

  • 1 workbook

    Your Planning rows, filled in as you go

  • Certificate

    Pass the final assessment at 80%. Earn 2.75 CPE

Know it,
lock it down,
control every change

Configuration Management is where a system's security either holds steady or slowly drifts. Its 10 active requirements break into 61 determination statements in SP 800-171A, and 12 of those are organization-defined parameters, from review frequencies to the functions, ports, and services you restrict. Revision 3 adds requirements for component inventory, information location, and systems taken into high-risk areas, and 2 Revision 2 requirements are now withdrawn.

This course takes every requirement through the same three steps. First you learn what it asks for and the risk behind it. Then you see a practical way to put it in place that fits your environment. Last, you learn how it gets assessed and what evidence proves it. A running case, Harbor Point Machining (a fictional company), shows each step on a system that looks like yours.

By the end, you'll be able to

  • Explain what each Configuration Management requirement asks for and the risk it addresses

  • Set the family's 12 organization-defined parameter values and record who approved each one

  • Plan baselines, secure settings, change control, least functionality, allowed software, and an inventory that shows where CUI lives

  • Choose evidence for each determination statement and spot the gaps that lead to "other than satisfied"

  • Roll up your Planning readiness with your top gaps, owners, and dates

Leave with your Configuration Management rows filled in, not just notes

In the Overview you'll download the Master Readiness Workbook, the one spreadsheet you'll use across every family course, along with a Control Reference Guide for each of the 10 requirements. Every chapter ends with you recording that requirement's parameter values, evidence, owners, and gaps. In the Wrap-Up you roll the family up into one readiness view, with your top three gaps and an owner and date for each. Use sanitized descriptions only, and never enter CUI. The workbook is a working record. It moves the work forward, but it isn't proof of compliance.

Course curriculum

12 chapters · 62 lessons · about 2.5 hours

    1. Configuration Management Overview | Family Overview

      FREE PREVIEW

    2. Configuration Management Overview | Your Downloads

    1. 03.04.01 | Control Reference Guide

    2. 03.04.01 | Lesson 1: Understand the Requirement

    3. 03.04.01 | Lesson 2: Implement the Requirement

    4. 03.04.01 | Lesson 3: Assess and Prove the Requirement

    5. 03.04.01 | Knowledge Check

    6. 03.04.01 | Requirement Summary

    1. 03.04.02 | Control Reference Guide

    2. 03.04.02 | Lesson 1: Understand the Requirement

    3. 03.04.02 | Lesson 2: Implement the Requirement

    4. 03.04.02 | Lesson 3: Assess and Prove the Requirement

    5. 03.04.02 | Knowledge Check

    6. 03.04.02 | Requirement Summary

    1. 03.04.03 | Control Reference Guide

    2. 03.04.03 | Lesson 1: Understand the Requirement

    3. 03.04.03 | Lesson 2: Implement the Requirement

    4. 03.04.03 | Lesson 3: Assess and Prove the Requirement

    5. 03.04.03 | Knowledge Check

    6. 03.04.03 | Requirement Summary

    1. 03.04.04 | Control Reference Guide

    2. 03.04.04 | Lesson 1: Understand and Implement the Requirement

    3. 03.04.04 | Lesson 2: Assess and Prove the Requirement

    4. 03.04.04 | Knowledge Check

    5. 03.04.04 | Requirement Summary

    1. 03.04.05 | Control Reference Guide

    2. 03.04.05 | Lesson 1: Understand the Requirement

    3. 03.04.05 | Lesson 2: Implement the Requirement

    4. 03.04.05 | Lesson 3: Assess and Prove the Requirement

    5. 03.04.05 | Knowledge Check

    6. 03.04.05 | Requirement Summary

About this course

  • $199.00

Everything in the course, for 12 months

One payment covers all 10 Configuration Management requirement chapters, a Control Reference Guide for each requirement, the Master Readiness Workbook, the final assessment, and your certificate. Work at your own pace, with 12 months of access.

People responsible for putting NIST SP 800-171 Configuration Management requirements in place at federal contractors that handle CUI. We recommend taking NIST SP 800-171 Rev. 3 Foundations first.

  • Compliance leads

    Who own the baselines, the change process, and the records behind them.

  • IT and security staff

    Who build hardened configurations, run changes, and keep the inventory current.

  • Consultants and MSPs

    Who manage configurations and change control across many clients.

  • Managers

    Who approve changes, set review cycles, and decide which software is allowed.

Instructor

Brian Hubbard

Lead CCA

Brian Hubbard is President of Evolved Cyber and has more than 40 years of cybersecurity experience supporting federal contractors, the defense community, and the intelligence community. A Lead Certified CMMC Assessor and CMMC instructor, he has led certification assessments and helped organizations prepare to demonstrate how their security programs work in practice. Brian also contributed to the original NIST Cybersecurity Framework. In this course, he brings that experience to NIST SP 800-171 Revision 3, helping leaders understand its implications for governance, systems, documentation, suppliers, and assessment readiness.

FAQ

  • Do I need to take Foundations first?

    It's recommended, not required. Foundations teaches the method for reading Revision 3 requirements, parameters, and assessment objectives that every family course builds on.

  • Which requirements and values apply to my organization?

    The agreements that cover your system determine which requirements and parameter values apply. The course shows you how to find and record them.

  • Is the certificate a professional certification?

    No. It confirms you completed this course and passed its final assessment.

  • Can I enter real system details in the workbook?

    Use sanitized descriptions only. Never put CUI in the workbook.

  • How long do I have access?

    12 months from the day you enroll.

  • Is this course part of a bundle?

    Yes. Configuration Management is in the Technical Safeguards bundle ($999) and Complete Control Mastery ($1,495). Every bundle includes Foundations.

One requirement at a time, from reading it to proving it.

Fifteen minutes or less per requirement, and every one ends with something real in your workbook.

Enroll Now