CAP Security Control Assessment & Security Assessment Reports (SAR)

Question 1

Which NIST publication provides the methodology for assessing the effectiveness of security controls in federal information systems?

Accepted Answer

NIST SP 800-53A

Answer

NIST SP 800-53A ('Assessing Security and Privacy Controls in Information Systems and Organizations') provides the procedures for assessing each control in NIST SP 800-53. It defines assessment methods (examine, interview, test) and procedures aligned to each control.

Question 2

NIST SP 800-53A defines three assessment methods. Which set correctly identifies all three?

Accepted Answer

Examine, Interview, Test

Answer

NIST SP 800-53A defines three assessment methods: Examine (reviewing documentation and artifacts), Interview (discussing controls with personnel), and Test (exercising the control through technical or operational means). These three methods together provide comprehensive coverage of control effectiveness.

Question 3

What is the primary output document produced at the conclusion of a security control assessment?

Accepted Answer

Security Assessment Report (SAR)

Answer

The Security Assessment Report (SAR) documents the assessor's findings, including which controls are effective (satisfied), which are partially effective (other than satisfied), and which are ineffective (not satisfied). The SAR is a key input to the authorization decision.

Question 4

Why is assessor independence important in the security control assessment process?

Accepted Answer

It prevents conflicts of interest where the assessor might overlook deficiencies in controls they helped implement.

Answer

Assessor independence (as described in NIST SP 800-37 and SP 800-53A) is critical because individuals who designed or implemented controls have an inherent conflict of interest when assessing those same controls. Independent assessment provides objective, unbiased results for the AO's decision.

Question 5

After a security assessment identifies control weaknesses that cannot be immediately remediated, what document is used to track the planned remediation actions?

Accepted Answer

Plan of Action and Milestones (POA&M)

Answer

The Plan of Action and Milestones (POA&M) is the formal document used to track identified weaknesses, the actions planned to correct them, the resources required, and the target completion dates. The POA&M is reviewed by the AO as part of the authorization package.

(CAP) Certified Authorization Professional Practice Test

(CAP) Certified Authorization Professional Practice Test

CAP Security Control Assessment & Security Assessment Reports (SAR)