Risk Management Framework (RMF) Flashcards

Which RMF step results in the formal decision to authorize a system to operate?

Answer: Authorize

The Authorize step is where the Authorizing Official reviews the risk and formally grants an Authorization to Operate (ATO).

What document serves as the primary contract between the system owner and the Authorizing Official during RMF?

Answer: System Security Plan

The System Security Plan (SSP) describes how security requirements are met and forms the basis for the authorization decision.

In RMF terminology, what is a 'common control'?

Answer: A control inherited by multiple systems from a shared provider

Common controls are security controls that can be inherited by multiple information systems from a centralized provider, reducing duplication.

Which NIST publication provides guidance on security and privacy controls for federal information systems?

Answer: NIST SP 800-53

NIST SP 800-53 provides the catalog of security and privacy controls used during the RMF Select step.

What is the purpose of FIPS 199 in the RMF process?

Answer: Establishing security categorization standards

FIPS 199 establishes standards for categorizing federal information and information systems based on potential impact (low, moderate, high).

The RMF Implement step requires that security controls be implemented in accordance with which document?

Answer: System Security Plan

Controls are implemented as described in the System Security Plan, which documents how each control is satisfied.