CAP Security Authorization Documentation 2

Question 1

What is the difference between an Authorization to Operate (ATO) and an Interim Authorization to Operate (IATO)?

Accepted Answer

An ATO is a full authorization; an IATO is a time-limited authorization granted while residual risks are being mitigated

Answer

An ATO is for classified systems; an IATO is for unclassified systems

Answer

An ATO requires FISMA compliance; an IATO does not

Answer

An ATO is issued by the ISSO; an IATO is issued by the AO

Question 2

What does an Authorization Denial (DATO) indicate?

Accepted Answer

The AO has determined the risk is unacceptable and the system must not operate

Answer

The system passed all security controls but lacks documentation

Answer

The ATO has expired and requires renewal

Answer

The system has minor findings that need remediation

Question 3

Which control family in NIST SP 800-53 specifically addresses planning and the System Security Plan?

Accepted Answer

PL (Planning)

Answer

CA (Assessment, Authorization, and Monitoring)

Answer

SA (System and Services Acquisition)

Answer

RA (Risk Assessment)

Question 4

How frequently must federal agencies review and update their System Security Plans per NIST guidance?

Accepted Answer

At least annually or whenever significant changes occur

Answer

Every five years during reauthorization

Answer

Only when a security incident occurs

Answer

Quarterly regardless of system changes

Question 5

What is the purpose of a Privacy Impact Assessment (PIA) in the authorization process?

Accepted Answer

To identify and evaluate privacy risks associated with the collection or use of personally identifiable information

Answer

To assess physical security of server rooms

Answer

To verify that encryption algorithms meet FIPS 140-2 standards

Answer

To document user access rights and privileges

Question 6

Which NIST publication provides guidance on preparing the authorization package and submitting it to the AO?

Accepted Answer

NIST SP 800-37

Answer

NIST SP 800-53A

Answer

NIST SP 800-30

Answer

NIST SP 800-60