Compliance and Policy Flashcards

An organization is authorizing a system whose security categorization under FIPS 199 and NIST SP 800-60 is Moderate. Midway through the Select step, the system owner adds a new mission function that processes a data type whose provisional impact levels are High for confidentiality. The AO has not yet reviewed the security plan. What is the MOST appropriate action under the RMF?

Answer: Revisit the Categorize step, update the categorization (high-water mark), and re-select the control baseline accordingly

Under the high-water mark principle, the system's overall impact level is the highest impact among confidentiality, integrity and availability. A new data type with a High confidentiality impact changes the categorization, so the Categorize step must be revisited and the baseline re-selected before moving on. Documenting the gap in a POA&M or deferring controls until after authorization does not address the incorrect categorization, and an ATU depends on a reciprocal authorization package that does not replace correct categorization.

A system has an ATO issued under an ongoing authorization approach with a mature continuous monitoring program. The ISSO reports that a significant change is planned: migrating the system's database tier to a different cloud service provider with an inherited FedRAMP High authorization. Which action BEST reflects NIST SP 800-37 Rev. 2 guidance?

Answer: Perform a security impact analysis, update the affected control assessments and the authorization package, and have the AO determine whether the change affects the authorization decision

A significant change requires a security impact analysis and reassessment of affected controls, including the customer-responsible and inherited controls and the interconnections. The AO then decides whether the risk is still acceptable or a new or updated authorization is needed. A provider's FedRAMP authorization does not eliminate the system owner's responsibility, and the change does not automatically require revocation or a full restart.

During an assessment, the SCA finds that a common control provided by the enterprise's centralized identity service is only partially effective. Twelve information systems inherit this control. Which statement describes the correct risk-management responsibility?

Answer: The common control provider must remediate or have the weakness tracked, and the findings must be communicated to every inheriting system's AO and owner, who determine the impact on their own risk posture

NIST SP 800-37 holds common control providers responsible for the implementation, assessment and monitoring of the controls they provide, and for sharing the assessment results and the authorization with inheriting system owners. Each inheriting system's AO considers that information when making risk decisions. Inheriting systems are not required to reassess the control independently, but they cannot ignore a known weakness. Automatic withdrawal of authorizations is not the prescribed response.

An organization subject to a regulation requiring that personal data of EU residents not be transferred to certain jurisdictions discovers that a SaaS vendor's subprocessor, located in a non-adequate country, has been receiving pseudonymized data for six months. The vendor's contract has a standard DPA but no subprocessor notification clause. What should the compliance lead do FIRST?

Answer: Assess whether the transfer constitutes a reportable breach or unlawful transfer, determine the legal basis and safeguards available such as SCCs, and involve legal and the DPO

Pseudonymized data is still personal data because it can be re-identified using additional information. The first step is to assess the legal exposure, which means whether the transfer was unlawful, whether safeguards like standard contractual clauses or a transfer impact assessment exist, and whether notification duties are triggered, with legal counsel and the DPO involved. Terminating the contract abruptly or reclassifying the data is unsupported, and delaying risks continued violation.

A security control assessor finds that a policy exists, is approved by executive leadership, and is published, but interviews reveal that staff in two business units follow a different, undocumented process. Using the NIST SP 800-53A assessment methods, which combination of evidence would MOST reliably determine whether the control is actually implemented and operating as intended?

Answer: Examine the policy, interview the staff in both business units, and test by observing the actual process or reviewing generated artifacts such as logs and tickets

NIST SP 800-53A uses the methods of examine, interview and test. Policy documents show intent, but only interviews with the operators combined with test or observation of actual outputs show whether the control operates as intended. Relying on the author, executives or manager attestations leaves the discrepancy unexamined.

An agency has a system with several open POA&M items. One High-severity item has passed its scheduled completion date because a vendor patch is unavailable, and compensating controls have been partially implemented. The AO is considering extending the ATO. Which course of action is MOST consistent with RMF risk management principles?

Answer: Update the POA&M with a revised date and milestones, reassess the residual risk with the compensating controls, and have the AO make a documented, risk-based decision on continued authorization with any conditions

A delayed POA&M item requires an updated plan with revised milestones and a reassessment of residual risk, taking the compensating controls into account. The AO then makes an informed and documented risk decision, which may include conditions or a time-limited extension. Silently extending, removing, or downgrading the item undermines the integrity of the risk management process.