Risk Management Framework Flashcards

What does FISMA stand for and what does it mandate?

Answer: Federal Information Security Modernization Act; mandates federal agencies implement RMF-based security programs

FISMA requires federal agencies to develop, document, and implement information security programs aligned with the RMF.

What NIST publication provides guidance on organizational risk management as the overarching context for the RMF?

Answer: NIST SP 800-39

NIST SP 800-39 addresses managing information security risk at the organization, mission/business, and information system tiers.

In the RMF three-tier hierarchy, which tier addresses mission and business process risk?

Answer: Tier 2

Tier 2 (Mission/Business Process) addresses risk at the mission and business process level between organizational leadership and system owners.

Which term describes the maximum acceptable downtime for a system as defined in a Business Impact Analysis?

Answer: Maximum Tolerable Downtime (MTD)

MTD is the longest period an organization can survive without a critical system before business operations are permanently impaired.

What is the primary goal of tailoring baseline security controls in the RMF?

Answer: To adjust controls to the specific conditions, threat environment, and risk tolerance of the system

Tailoring allows organizations to customize baseline controls to fit their specific operational environment, threat landscape, and risk posture.

Which federal law requires Authorizing Officials to be senior agency officials with budget authority?

Answer: FISMA

FISMA requires that AOs be senior agency officials with authority over the resources and operations of the systems they authorize.