CAP Security Authorization Documentation 3

Question 1

What is a 'significant change' that would require reauthorization of a federal information system?

Accepted Answer

A major upgrade to system architecture, operating environment, or security posture that increases risk

Answer

Significant changes such as new external interconnections, major software upgrades, or changes to the threat environment may trigger reauthorization.

Question 2

What is the role of the Information System Security Officer (ISSO) in documentation management?

Accepted Answer

To develop, maintain, and update security documentation including the SSP and POA&M

Answer

The ISSO is responsible for day-to-day security documentation management, including keeping the SSP current and tracking POA&M items.

Question 3

Which artifact documents interconnections between an information system and external systems?

Accepted Answer

Interconnection Security Agreement (ISA) / Memorandum of Understanding (MOU)

Answer

ISAs (often paired with MOUs) formally document the terms, security requirements, and authorizations for system interconnections.

Question 4

What is the maximum ATO period allowed for most federal information systems under NIST guidance?

Accepted Answer

Three years

Answer

NIST SP 800-37 recommends a maximum three-year ATO period before reauthorization is required.

Question 5

What must the POA&M include for each identified security weakness?

Accepted Answer

Description of the weakness, responsible party, scheduled completion date, and resources needed

Answer

A complete POA&M entry includes what the weakness is, who owns remediation, when it will be fixed, and what resources are required.

CAP - Certified Accreditation Professional Practice Test