CAP Risk Management Framework 1 — Questions and Answers
Question 1: Which NIST publication provides the primary guidance for the Risk Management Framework (RMF) used in CAP?
- NIST SP 800-37 (Correct answer)
- NIST SP 800-53
- NIST SP 800-171
- NIST SP 800-30
Correct answer: NIST SP 800-37
NIST SP 800-37 provides the foundational guidance for the Risk Management Framework used across federal systems.
Question 2: What is the correct order of the first three steps in the NIST RMF?
- Prepare, Categorize, Select (Correct answer)
- Categorize, Select, Implement
- Select, Implement, Assess
- Prepare, Select, Categorize
Correct answer: Prepare, Categorize, Select
The RMF begins with Prepare, then Categorize, then Select controls before implementation.
Question 3: Which RMF step involves choosing security controls from NIST SP 800-53?
- Select (Correct answer)
- Implement
- Assess
- Authorize
Correct answer: Select
The Select step involves choosing appropriate security controls tailored to the system's risk profile.
Question 4: What document formally records the selected security controls for an information system during the RMF?
- System Security Plan (SSP) (Correct answer)
- Plan of Action and Milestones (POA&M)
- Security Assessment Report (SAR)
- Authorization to Operate (ATO)
Correct answer: System Security Plan (SSP)
The System Security Plan documents the security controls selected and implemented for the system.
Question 5: In the RMF, which step involves the Authorizing Official making an accept/reject risk decision?
- Authorize (Correct answer)
- Assess
- Monitor
- Select
Correct answer: Authorize
The Authorize step is where the AO reviews the risk assessment package and decides to grant or deny an ATO.
Question 6: Which NIST publication provides guidance on security and privacy controls referenced during the RMF Select step?
- NIST SP 800-53 (Correct answer)
- NIST SP 800-37
- NIST SP 800-60
- NIST SP 800-39
Correct answer: NIST SP 800-53
NIST SP 800-53 is the catalog of security and privacy controls used during the Select step of the RMF.
CAP Risk Management Framework 1
Which NIST publication provides the primary guidance for the Risk Management Framework (RMF) used in CAP?