Risk Management Framework Flashcards

Which NIST publication provides the primary guidance for the Risk Management Framework (RMF) used in CAP?

Answer: NIST SP 800-37

NIST SP 800-37 provides the foundational guidance for the Risk Management Framework used across federal systems.

What is the correct order of the first three steps in the NIST RMF?

Answer: Prepare, Categorize, Select

The RMF begins with Prepare, then Categorize, then Select controls before implementation.

Which RMF step involves choosing security controls from NIST SP 800-53?

Answer: Select

The Select step involves choosing appropriate security controls tailored to the system's risk profile.

What document formally records the selected security controls for an information system during the RMF?

Answer: System Security Plan (SSP)

The System Security Plan documents the security controls selected and implemented for the system.

In the RMF, which step involves the Authorizing Official making an accept/reject risk decision?

Answer: Authorize

The Authorize step is where the AO reviews the risk assessment package and decides to grant or deny an ATO.

Which NIST publication provides guidance on security and privacy controls referenced during the RMF Select step?

Answer: NIST SP 800-53

NIST SP 800-53 is the catalog of security and privacy controls used during the Select step of the RMF.