CGRC Information Security Controls Flashcards

What is the purpose of a System Security Plan (SSP) in the RMF process?

Answer: To describe the security requirements and controls implemented for a system

An SSP formally documents a system's security requirements, the controls selected to meet those requirements, and the roles responsible for implementation.

Which concept refers to a system's ability to inherit security controls implemented by a common control provider?

Answer: Control inheritance

Control inheritance allows a system to leverage and rely on controls already implemented by a shared infrastructure or service provider without re-implementing them.

What is a compensating control?

Answer: An alternative control used when the required control cannot be implemented

A compensating control provides equivalent protection when the primary required control cannot be implemented due to technical or operational constraints.

Which FIPS standard is used to categorize federal information and information systems based on potential impact?

Answer: FIPS 199

FIPS 199 defines the standards for categorizing information and information systems as Low, Moderate, or High based on confidentiality, integrity, and availability impacts.

In NIST SP 800-53, what does the CM control family address?

Answer: Configuration Management

The CM (Configuration Management) family includes controls for establishing and maintaining baseline configurations and tracking changes to systems.

What is the role of the System Owner in relation to security controls under the RMF?

Answer: Ensuring controls are implemented, documented, and maintained for their system

The System Owner is responsible for ensuring that security controls are properly implemented, documented in the SSP, and kept current throughout the system lifecycle.