Compliance Programs Flashcards

An agency wants to move a moderate-impact system from a fixed three-year reauthorization cycle to ongoing authorization under NIST SP 800-37 Rev. 2. Which condition must be met before the authorizing official (AO) can approve this change?

Answer: The system already has an initial authorization, and a continuous monitoring program gives the AO current, risk-relevant information at a defined frequency

Under SP 800-37 Rev. 2, a system can move to ongoing authorization only after it has an initial authorization and is backed by a mature continuous monitoring program. That program has to keep giving the AO current information about security and privacy posture so the AO can keep accepting the risk. An empty POA&M, IG certification and full automation are not requirements. Many controls cannot be automated at all.

During its annual assessment, a common control provider finds a deficiency in an enterprise-wide incident response capability. Twelve systems inherit this control. Who is primarily responsible for documenting the deficiency and the plan to fix it?

Answer: The common control provider, in its POA&M, and the inheriting system owners are told so they can assess the effect on their systems

Common control providers are responsible for documenting and fixing weaknesses in the controls they provide, including tracking them in their own POA&Ms. Inheriting system owners need to know about the weakness because it affects their residual risk. However, fixing it is not their job, and twelve duplicate POA&Ms would split accountability. Assessors find and report deficiencies. They do not fix them.

A federal agency plans to adopt a SaaS product that already holds a FedRAMP authorization based on a third-party assessment. The agency AO reviews the existing authorization package and decides to accept the shared risk without a new assessment. Which SP 800-37 Rev. 2 authorization decision best fits this situation?

Answer: Authorization to Use (ATU)

SP 800-37 Rev. 2 defines an Authorization to Use for cases where an organization relies on a system, service or application that another organization has already authorized, using the existing evidence (reciprocity). An ATO applies to systems the organization owns and operates. A Common Control Authorization covers inheritable controls. An IATT is not one of the formal decision types in Rev. 2.

An assessment shows a system implements 100% of its tailored control baseline with no 'other than satisfied' findings. However, new threat intelligence shows that adversaries are actively targeting this type of system with a technique the baseline does not address. What is the most appropriate response from the AO?

Answer: Base the decision on risk, not compliance alone, and require additional or supplemental controls, or deny authorization, if residual risk is unacceptable

Compliance does not equal acceptable risk. The RMF authorization decision is a risk-based judgment by the AO about residual risk to operations, assets, individuals and the Nation. A system can meet its baseline and still carry unacceptable risk when the threat landscape changes. In that case the AO can require tailored or supplemental controls, or deny authorization. Waiting for NIST, or waiving the threat without analysis, gives up the AO's accountability.

An AO formally appoints a designated representative to help manage a large portfolio of systems. Which activity can the designated representative NOT perform on the AO's behalf?

Answer: Making the authorization decision and signing the authorization decision document

Under SP 800-37 Rev. 2, the AO can delegate almost every authorization-related task to a designated representative. The exceptions are making the authorization decision and signing the decision document, which includes formally accepting risk. That accountability stays with the senior official who has the authority to accept risk for the organization.

An organization is building its information security continuous monitoring (ISCM) strategy under NIST SP 800-137. Which factor should most directly determine how often a specific control is monitored?

Answer: The volatility of the control (how often it is likely to change), together with its criticality and known weaknesses

SP 800-137 says monitoring frequency should be risk-based, mainly driven by control volatility. Controls that change often, such as configuration settings, need more frequent monitoring than stable ones, such as policy documents. Criticality, identified weaknesses and the threat environment also matter. A single frequency per family, or tying frequency to the authorization cycle, ignores risk. Inherited controls still need monitoring, normally by the common control provider, and the results must reach the inheriting systems.