CAP Federal Information Security Laws, Policies & the Legislative Framework

Question 1

Which U.S. federal law established the requirement for federal agencies to develop, document, and implement an information security program, and made NIST responsible for developing security standards and guidelines?

Accepted Answer

The Federal Information Security Management Act (FISMA) of 2002

Answer

FISMA 2002 (part of the E-Government Act) is the foundational federal law requiring agencies to implement agency-wide information security programs. It mandated NIST to develop standards (FIPS) and guidelines (SP 800-series) for federal information security.

Question 2

The Federal Information Security Modernization Act (FISMA) of 2014 made which significant change to the original 2002 law?

Accepted Answer

It shifted FISMA oversight from OMB to DHS for operational civilian agency oversight, and emphasized continuous monitoring over periodic assessments.

Answer

FISMA 2014 modernized the 2002 law by giving DHS a more active role in operational oversight of civilian agencies (while OMB retained policy authority), strengthening continuous monitoring requirements, and increasing incident reporting obligations — reflecting the shift away from compliance-driven point-in-time assessments.

Question 3

OMB Circular A-130 is significant to the CAP domain because it:

Accepted Answer

Sets policy for managing federal information resources and requires agencies to implement NIST-based security controls.

Answer

OMB Circular A-130 ('Managing Information as a Strategic Resource') establishes government-wide policy for the management of federal information resources, including a requirement to implement security controls consistent with NIST standards. It is the policy backbone that makes the RMF mandatory for federal civilian agencies.

Question 4

Under FISMA, which official has the authority to grant an Authorization to Operate (ATO) for a federal information system?

Accepted Answer

The Authorizing Official (AO), also known as the Designated Accrediting Authority (DAA)

Answer

The Authorizing Official (AO) — historically called the Designated Accrediting Authority (DAA) — is the senior federal official with the authority and accountability to grant an ATO. The AO accepts the residual risk of operating a system based on the authorization package and current security posture.

Question 5

Which federal agency is responsible for developing mandatory standards (FIPS) and voluntary guidelines (SP 800-series) for federal information systems under FISMA?

Accepted Answer

The National Institute of Standards and Technology (NIST)

Answer

FISMA explicitly tasks NIST with developing FIPS (Federal Information Processing Standards, which are mandatory) and Special Publications in the 800-series (which are guidelines). DHS handles operational oversight; OMB handles policy; GAO audits compliance — but only NIST creates the technical standards.

(CAP) Certified Authorization Professional Practice Test

(CAP) Certified Authorization Professional Practice Test

CAP Federal Information Security Laws, Policies & the Legislative Framework