Audit Management Flashcards

During planning for an engagement to assess a system's security controls, the assessor discovers that the system owner has scheduled interviews and examinations but has not provided a complete list of inherited common controls. According to NIST SP 800-53A assessment methodology, what is the MOST appropriate way to treat the inherited controls in the assessment?

Answer: Use the assessment results and authorization documentation from the common control provider, and assess only the system-specific implementation or customer-responsible portions

Under NIST SP 800-53A and RMF Task A-4 and A-5 guidance, assessors may reuse and leverage assessment evidence from common control providers. They then assess only the system-specific or hybrid portions that the system owner is responsible for. Excluding inherited controls or marking them N/A would leave gaps in the control coverage. Re-testing everything is unnecessary duplication.

An independent assessor finds that a system's continuous monitoring plan relies solely on annual vulnerability scans for a high-impact system whose controls are mostly automated. Which audit finding is MOST defensible under the RMF Monitor step (Task M-2)?

Answer: The monitoring frequency is not commensurate with the system's impact level, volatility of controls, and organizational risk tolerance, so the strategy must be revised

NIST SP 800-137 requires that monitoring frequency be determined by control volatility, system impact level, threat information, and risk tolerance. Annual-only scanning of a high-impact system with automated controls is inadequate. Continuous or near-real-time monitoring is appropriate. It does not require annual reauthorization, and the SSP signature is irrelevant to frequency adequacy.

During an audit, an assessor determines that a control marked 'Implemented' in the SSP was in fact only partially implemented, and that the assessment report shows the control as 'Other Than Satisfied' with a moderate-risk weakness. The system owner wants to remediate during the assessment so the finding can be removed from the report. What is the BEST course of action?

Answer: Retain the finding in the report, document the corrective action taken and any retest results, and update the SSP and POA&M accordingly

Assessment integrity requires that the original finding be preserved. Remediation performed during assessment can be documented along with retest evidence, and the SSP and POA&M should be updated to reflect it, but the finding should not be erased. This maintains an accurate audit trail for the authorizing official.

A system security officer proposes to use the same individual who designed and implemented a set of technical controls to perform the independent assessment of those controls. For a high-impact system under NIST RMF guidance, what is the primary concern?

Answer: The assessor would be reviewing their own work, creating a conflict that undermines the independence required for an unbiased assessment, especially for high-impact systems

NIST SP 800-53A and the RMF call for assessor independence, with greater independence expected as system impact increases. Designer and implementer assessing their own work is a self-review threat. Assessors may be internal to the organization as long as they are organizationally independent of the system owner's chain for the work in question.

An assessor evaluating the control AC-2 (Account Management) uses the Examine, Interview, and Test methods. The system owner provides a current account list and the interview confirms quarterly reviews, but a Test of 25 sampled accounts reveals 4 terminated employees with active accounts. Which statement BEST describes how the assessor should proceed?

Answer: Report the test discrepancy as a deficiency, since the Test method provides direct evidence that contradicts the documented and described process, and consider the depth and coverage of further testing

Test results provide direct empirical evidence of operation. When they conflict with documentary and interview evidence, the assessor must report the deficiency and may need to increase depth and coverage (for example, a larger sample). Re-sampling to obtain agreement is a bias, and lowering depth to avoid a finding is improper.

A POA&M item for a moderate-severity weakness has been delayed twice and now exceeds its scheduled completion date. The system owner requests a new date without additional justification. What should the audit/compliance reviewer recommend?

Answer: Require documented justification for the delay, updated milestones with resources, and escalation to the authorizing official for risk acceptance if the delay persists

POA&M changes to scheduled completion dates should be accompanied by documented justification, revised milestones, and resource information. Repeated delays raise the residual risk and should be elevated to the authorizing official for a risk-based decision. Risk acceptance is an AO responsibility, and removing items weakens traceability.