Compliance and Policy Flashcards

An organization is authorizing a system whose security categorization under FIPS 199 and NIST SP 800-60 yields Confidentiality=Moderate, Integrity=High, Availability=Low. The system owner proposes selecting the Moderate baseline from SP 800-53B because two of three impact levels are at or below Moderate. Which response is MOST consistent with the RMF Categorize and Select steps?

Answer: Select the High baseline, because the high-water mark of the security objectives sets the system's overall impact level and baseline

Under FIPS 200 and SP 800-53B, the overall system impact level is the high-water mark across confidentiality, integrity, and availability. Integrity=High therefore yields the High baseline. Tailoring may later adjust individual controls, but the starting baseline is set by the high-water mark, not by majority or per-objective selection.

During continuous monitoring, an authorizing official (AO) learns that a common control provider's inherited control, SC-7 Boundary Protection, has been found Other Than Satisfied in the provider's latest assessment. Fifteen systems inherit this control. What is the MOST appropriate action for each inheriting system owner?

Answer: Treat the inherited control as not implemented for their system, assess the resulting risk, update the POA&M and risk posture, and notify their AO so the risk decision can be revisited

Inheriting systems remain accountable for the risk that inherited controls introduce. A deficiency in a common control changes each system's risk posture, so system owners must evaluate the impact, record POA&M items as needed, and inform their AO, who decides whether to continue operation. Automatic revocation or removal of the control is not required or appropriate.

A federal agency's system processes records subject to the Privacy Act. The system owner has completed an assessment and the security controls are satisfactory, but no System of Records Notice (SORN) has been published. From a compliance standpoint, which statement is MOST accurate?

Answer: The system may not lawfully operate as a system of records until the SORN is published in the Federal Register and the comment period requirements are met, so the AO should account for this before granting authorization

The Privacy Act requires agencies to publish a SORN in the Federal Register for systems of records retrieving information by personal identifier, and new or significantly modified uses require advance notice and a comment period. Privacy requirements are part of the authorization decision under the RMF, so the AO should not authorize operation while this statutory requirement is unmet. The SORN does not depend on impact level, and a PTA only helps determine whether a PIA or SORN is needed.

An organization wants to move from a periodic three-year reauthorization cycle to ongoing authorization under SP 800-37 Rev. 2. Which prerequisite is MOST essential before the AO can formally adopt ongoing authorization?

Answer: An approved information security continuous monitoring (ISCM) strategy exists and the AO has visibility into control effectiveness and risk through near-real-time or sufficiently frequent monitoring

SP 800-37 Rev. 2 states that ongoing authorization requires an organization-level and system-level ISCM program, with an approved strategy that gives the AO sufficient, current information to make timely risk-based decisions. It is not limited to Low systems, does not require common controls, and does not require zero POA&M items, since POA&Ms are managed risk.

A system security officer proposes tailoring a baseline by removing an AC-2(4) automated audit actions enhancement because the organization's identity management tool does not support it. The organization instead documents that manual monthly reviews of account actions will provide equivalent coverage. Which tailoring concept does this BEST represent, and what must accompany it?

Answer: Compensating control; it must be documented with rationale showing it provides equivalent protection, and be approved by the appropriate authority and assessed

Replacing a baseline control or enhancement with an alternative safeguard is a compensating control under tailoring. SP 800-53 and 800-53B require documented rationale showing the compensating control provides equivalent or comparable protection, approval by the organization's designated authority, and inclusion in assessment. Scoping and overlays are different tailoring mechanisms, and acceptance without documentation would not satisfy the requirement.

A cloud service provider (CSP) holds a FedRAMP Moderate authorization. A federal agency wants to use the service for a system that requires a mission-specific control not included in the FedRAMP Moderate baseline. How should the agency BEST handle this?

Answer: Leverage the existing FedRAMP authorization package, identify the gap, and have the agency implement or obtain assurance for the additional control as part of its own agency authorization and customer responsibilities

FedRAMP follows a 'do once, use many times' approach. Agencies leverage the CSP's authorization package, then address agency-specific controls, parameters, and customer responsibilities in their own authorization decision. This avoids duplicate assessment while still covering mission-specific needs. It does not require a High authorization or a change to the FedRAMP baseline.