CAP Documentation and Authorization Artifacts 2

Question 1

Rules of Behavior (RoB) documents are required to inform which stakeholders of their security responsibilities?

Accepted Answer

All users who access the information system

Answer

Rules of Behavior must be acknowledged by all users (employees, contractors, guests) who access the system before they are granted access.

Question 2

What is a Memorandum of Understanding (MOU) used for in the context of information system authorization?

Accepted Answer

Documenting agreed-upon responsibilities between two or more organizations sharing a system or service

Answer

An MOU documents the responsibilities and agreements between organizations regarding shared systems, services, or data.

Question 3

How does a Memorandum of Agreement (MOA) differ from a Memorandum of Understanding (MOU)?

Accepted Answer

An MOA is legally binding with specific commitments; an MOU is less formal and states intent

Answer

An MOA typically outlines binding commitments and obligations, while an MOU generally expresses a less formal mutual understanding.

Question 4

The authorization decision letter issued by the AO must include which key element?

Accepted Answer

The authorization termination date or conditions

Answer

The authorization decision letter must specify the authorization period or the conditions under which the authorization will be terminated.

Question 5

What is the role of the Information System Security Officer (ISSO) in maintaining authorization documentation?

Accepted Answer

Maintaining and updating system security documentation and coordinating with the AO

Answer

The ISSO is responsible for day-to-day security operations, ensuring documentation stays current, and reporting security status to the AO.

CAP - Certified Accreditation Professional Practice Test