CAP Risk Management Framework (RMF) 2

Question 1

Which RMF step results in the formal decision to authorize a system to operate?

Accepted Answer

Authorize

Answer

The Authorize step is where the Authorizing Official reviews the risk and formally grants an Authorization to Operate (ATO).

Question 2

What document serves as the primary contract between the system owner and the Authorizing Official during RMF?

Accepted Answer

System Security Plan

Answer

The System Security Plan (SSP) describes how security requirements are met and forms the basis for the authorization decision.

Question 3

In RMF terminology, what is a 'common control'?

Accepted Answer

A control inherited by multiple systems from a shared provider

Answer

Common controls are security controls that can be inherited by multiple information systems from a centralized provider, reducing duplication.

Question 4

Which NIST publication provides guidance on security and privacy controls for federal information systems?

Accepted Answer

NIST SP 800-53

Answer

NIST SP 800-53 provides the catalog of security and privacy controls used during the RMF Select step.

Question 5

What is the purpose of FIPS 199 in the RMF process?

Accepted Answer

Establishing security categorization standards

Answer

FIPS 199 establishes standards for categorizing federal information and information systems based on potential impact (low, moderate, high).

CAP - Certified Accreditation Professional Practice Test