Risk Assessment and Management Flashcards

During a CGRC risk assessment, a system owner proposes accepting a residual risk rated High for a moderate-impact system because remediation would exceed the system's annual budget. Under the NIST RMF (SP 800-37 Rev. 2) authorization process, who holds the authority to formally accept this risk on behalf of the organization?

Answer: The authorizing official, because they are the senior official who accepts risk to organizational operations, assets, and individuals

Under the RMF, the authorizing official (AO) is the senior management official with the authority to formally accept the risk to organizational operations and assets, individuals, other organizations, and the Nation. The system owner and ISSO provide information and recommendations, but they cannot accept risk on the organization's behalf. The CIO may be involved in risk executive functions, but the authorization decision itself belongs to the AO.

An organization has three subsystems that each use the same cloud provider's identity service. Individual assessments rate each subsystem's risk from that dependency as Low. A risk analyst argues that the combined risk is higher than any individual rating. Which risk management concept does this argument best reflect?

Answer: Aggregation of risk across common dependencies

Risk aggregation recognizes that a shared dependency can create a single point of failure with impact that exceeds the sum of independently assessed system-level risks. A compromise or outage of the common identity service would affect all three subsystems at once. This is why NIST SP 800-39 stresses viewing risk at the organization level (Tier 1) and mission/business process level (Tier 2) rather than only at the system level (Tier 3).

While performing a risk assessment under NIST SP 800-30 Rev. 1, a team determines that a threat event has a high likelihood of initiation, but the organization's existing controls make it unlikely to result in adverse impact. How does SP 800-30 direct the team to determine the overall likelihood of the threat event?

Answer: Combine the likelihood of initiation with the likelihood that the event results in adverse impact, to produce an overall likelihood

SP 800-30 Rev. 1 defines overall likelihood as a combination of the likelihood that a threat event will occur or be initiated and the likelihood that it will result in adverse impact, given that it occurs. Here the strong controls and low vulnerability reduce the second factor, so the overall likelihood is lower than the initiation likelihood alone suggests. Impact severity is evaluated separately and is not averaged into likelihood.

A federal agency is categorizing a system that processes both public press releases and sensitive law enforcement investigation records. Using the SP 800-60 approach for information types, how should the system's security categorization be determined?

Answer: Use the highest impact level among the information types for each security objective (the high-water mark)

FIPS 199 and SP 800-60 call for the high-water mark. For each security objective (confidentiality, integrity, availability), the system takes the highest provisional impact level among all the information types it processes. The result is that the law enforcement records drive the confidentiality rating even though the press releases are lower impact. Averaging or volume-based approaches would under-protect the most sensitive data.

After a risk assessment, management chooses to purchase cyber insurance to cover potential ransomware losses for a business-critical system, while making no changes to technical controls. Which risk response does this represent, and what is the important limitation to note?

Answer: Risk transfer, which shifts financial impact but does not remove the organization's accountability or the operational and reputational impact

Insurance is a form of risk sharing or transfer. It moves part of the financial consequence to a third party but does not reduce likelihood or eliminate the organization's accountability for the risk. Operational downtime, data loss, regulatory exposure, and reputational damage remain. The residual risk must still be documented, monitored, and, where applicable, accepted by the authorizing official.

During continuous monitoring, a significant change in the threat landscape raises the likelihood of a threat that was previously assessed as Low for a system with a current ATO. The new residual risk exceeds the AO's documented risk tolerance, although no system changes have occurred. What is the most appropriate action under the RMF?

Answer: Update the risk assessment and communicate the change to the AO so a risk-based decision can be made, such as modifying the POA&M, implementing additional controls, or revising the authorization

The Monitor step requires ongoing risk assessment and reporting to the AO. When residual risk moves beyond the AO's stated tolerance, the AO must be informed so they can make a risk-based decision about whether to continue operating with additional controls, an updated POA&M, or a changed authorization. Automatic revocation or waiting for the scheduled assessment are both inappropriate. Under ongoing authorization, the authorization decision is a living determination based on current risk, not a fixed one.