Security Controls and Authorization Flashcards

Which NIST SP 800-53 control family covers configuration management?

Answer: CM

The CM (Configuration Management) family includes controls for baseline configurations, change control, and software usage restrictions.

What is the purpose of an Interconnection Security Agreement (ISA)?

Answer: To document the security requirements for a connection between two systems

An ISA establishes the security interface requirements and responsibilities when two systems are interconnected.

Which document formally describes the security controls applied to a system and how they are implemented?

Answer: System Security Plan

The System Security Plan (SSP) comprehensively describes all security controls and their implementation details for the information system.

Which control overlay in NIST SP 800-53 provides additional guidance for classified national security systems?

Answer: CNSS Instruction 1253 overlay

CNSSI 1253 provides the security categorization and control selection guidance for national security systems.

What distinguishes a system-specific control from a hybrid control in NIST SP 800-53?

Answer: System-specific controls are implemented only for the local system; hybrid controls are shared and locally customized

Hybrid controls have portions implemented by a common control provider and portions implemented locally by the system owner.

Under FedRAMP, what authorization path allows agencies to reuse an existing cloud ATO?

Answer: Joint Authorization Board (JAB) Provisional ATO

A JAB Provisional ATO (P-ATO) issued by FedRAMP's Joint Authorization Board can be leveraged by multiple agencies through reciprocity.