Risk Management Framework Flashcards

A system owner's authorization package for a moderate-impact system is ready for the Authorizing Official. During continuous monitoring, a penetration test reveals a previously unknown vulnerability that the SCA assesses as high risk to the mission. The AO had already issued a 3-year ATO. Which action BEST aligns with NIST SP 800-37 Rev. 2 for how the AO should respond?

Answer: Review the updated risk information against the organization's risk tolerance and, if the risk is no longer acceptable, modify or withdraw the authorization decision or require a POA&M with mitigations

Under RMF Rev. 2, the Authorize/Monitor steps require the AO to continually evaluate risk as new information emerges. The AO compares the risk to the organization's risk tolerance and may keep, condition, modify, or withdraw the authorization. Revocation is not automatic, authorization decisions are not frozen for a term, and risk acceptance cannot be delegated to the system owner.

An organization wants to deploy a common control provided by a shared enterprise identity service for 40 systems. During the Select step, a system owner finds the provider's control assessment is 18 months old and the service's configuration changed substantially since. What should the system owner do FIRST regarding inheritance of this control?

Answer: Coordinate with the common control provider to determine whether the existing assessment evidence remains valid and request reassessment or updated evidence, since the inheriting system's risk depends on it

Inheriting systems rely on the common control provider's authorization and assessment evidence. When the underlying implementation changes or the evidence is stale, the system owner must work with the provider to confirm current effectiveness; the inherited control's weaknesses become risk to the inheriting system. Common controls are not exempt from monitoring, and an externally managed control is not 'not applicable'.

During the Categorize step for a system that processes both payroll data and public-facing job postings, the team proposes using the high-water mark for the system overall and applying differing impact levels to individual information types. Which statement about the FIPS 199 / SP 800-60 approach is MOST accurate?

Answer: The system's overall impact level is the highest value for each security objective (confidentiality, integrity, availability) across all information types, determined independently per objective

FIPS 199 uses the high-water mark applied per security objective: the system category is the highest impact value for confidentiality, integrity, and availability across its information types, e.g., SC = {(C, Moderate), (I, Moderate), (A, Low)}. It is not averaged, not limited to confidentiality, and Moderate on one objective does not force High.

A tailoring decision removes a baseline control because the system will not support the capability the control addresses. Which Select-step activity is MOST appropriate to document and defend this decision?

Answer: Record it as a scoping consideration with a rationale tied to the system's mission, environment, and risk assessment, and include it in the security plan for AO review

Tailoring (including scoping considerations) must be justified based on mission, operating environment, and risk, and documented in the security plan so the AO can review it when making the authorization decision. A POA&M is for known weaknesses in implemented controls, not for justified exclusions, and silent deletion violates documentation requirements.

A federal agency moves to ongoing authorization for a system under SP 800-37 Rev. 2. Which condition MOST directly supports the AO's ability to adopt ongoing authorization in place of periodic reauthorization?

Answer: The organization has an approved continuous monitoring strategy and the monitoring program provides sufficient, near-real-time visibility into control effectiveness and risk

Ongoing authorization requires that the organization's continuous monitoring program (per the ISCM strategy) give the AO enough timely information about control effectiveness and risk to make and sustain risk-based decisions. A clean POA&M or operating history is not the criterion, and the AO is still required to accept the risk.

During the Prepare step at the system level, which task is MOST specifically intended to reduce later rework in the Select and Implement steps while also supporting traceability of risk to mission?

Answer: Identifying and prioritizing the system's stakeholders, then identifying and tailoring the organization-level risk assumptions, constraints, and priorities

The Prepare step (system level) builds the foundation, including stakeholder identification, asset identification, and aligning organization-defined risk assumptions, constraints, priorities, and tolerance with the system, so later steps are consistent with enterprise risk strategy. Assessment and authorization occur in later steps, and the system description is a necessary input for categorization.