CAP Risk Management Framework 1

Question 1

Which NIST publication provides the primary guidance for the Risk Management Framework (RMF) used in CAP?

Accepted Answer

NIST SP 800-37

Answer

NIST SP 800-37 provides the foundational guidance for the Risk Management Framework used across federal systems.

Question 2

What is the correct order of the first three steps in the NIST RMF?

Accepted Answer

Prepare, Categorize, Select

Answer

The RMF begins with Prepare, then Categorize, then Select controls before implementation.

Question 3

Which RMF step involves choosing security controls from NIST SP 800-53?

Accepted Answer

Select

Answer

The Select step involves choosing appropriate security controls tailored to the system's risk profile.

Question 4

What document formally records the selected security controls for an information system during the RMF?

Accepted Answer

System Security Plan (SSP)

Answer

The System Security Plan documents the security controls selected and implemented for the system.

Question 5

In the RMF, which step involves the Authorizing Official making an accept/reject risk decision?

Accepted Answer

Authorize

Answer

The Authorize step is where the AO reviews the risk assessment package and decides to grant or deny an ATO.

CAP - Certified Accreditation Professional Practice Test