Risk Management and Compliance Flashcards

In a third-party risk management program, what document formally defines the security obligations of a vendor?

Answer: BAA (Business Associate Agreement) or security addendum

A BAA (required under HIPAA) or security addendum to a contract formally obligates vendors to meet specific security and data protection requirements.

What is the purpose of a System Security Plan (SSP) in a federal compliance context?

Answer: To document the security controls implemented for a specific information system

An SSP formally documents the security environment, controls, and responsibilities for a system, serving as the primary artifact in NIST RMF authorization.

Which of the following BEST describes quantitative risk analysis?

Answer: Assigning numerical monetary values to risk using metrics like ALE and SLE

Quantitative risk analysis uses formulas like ALE (Annual Loss Expectancy) = SLE × ARO to express risk in financial terms.

What is the purpose of a Plan of Action and Milestones (POA&M)?

Answer: To document known security weaknesses, remediation plans, and timelines for correction

A POA&M is a management tool that tracks security deficiencies, assigns responsibility, and establishes milestones for remediation.

An organization accepts a residual risk after applying all cost-effective controls. What formal step documents this acceptance?

Answer: An Authority to Operate (ATO) or formal risk acceptance sign-off by the Authorizing Official

An ATO is a formal authorization by a senior official accepting the residual risk of operating a system at an acceptable level.

Which security governance concept requires that multiple people must collaborate to perform sensitive actions, preventing unilateral misuse?

Answer: Two-person integrity (dual control)

Two-person integrity (dual control) requires two authorized individuals to be present or act together for sensitive operations, such as accessing cryptographic keys.