Risk Management Framework Flashcards

A system owner's authorization package for a moderate-impact system includes a POA&M with several open weaknesses. The Authorizing Official wants to grant an ATO but is concerned that residual risk from one unresolved high-severity finding is unacceptable for the full operational environment. Under NIST SP 800-37 Rev. 2, which authorization decision best addresses this concern while still permitting limited operation?

Answer: Issue an ATO that explicitly restricts operation (for example, limiting connections, user population, or data types) or imposes conditions on the authorization decision

NIST SP 800-37 Rev. 2 lets the AO issue an ATO with terms and conditions, including restrictions on operation, when residual risk is acceptable only under limited circumstances. A time-bound condition alone does not constrain the risk in the interim. An interim authority to test applies to pre-operational testing, not to operating the system. A denial is not required when risk can be made acceptable through constraints, and it does not require restarting at Select.

During the Prepare step at the organization level, a CISO defines common controls and designates control providers. Later, a system owner inherits a common control whose assessment evidence is more than 18 months old, and the provider's own authorization has lapsed. What is the most appropriate treatment of that control in the system's assessment?

Answer: Treat the inherited control as not currently supported by valid evidence, require the provider to reassess or reauthorize, and reflect the dependency risk in the system's authorization package

Inherited controls must be backed by current assessment and authorization evidence from the provider. If the provider's authorization has lapsed, the system owner cannot rely on stale evidence; the provider must reassess, and the dependency risk must be communicated to the AO in the package. Designation alone does not confer effectiveness, and a lapse does not make a control not applicable.

An organization moves a system from periodic reauthorization to ongoing authorization. Which condition is REQUIRED before the AO can rely on this approach under NIST SP 800-37 Rev. 2?

Answer: An organization-defined continuous monitoring strategy is in place, and the AO has an ongoing view of security and privacy posture sufficient to determine that risk remains acceptable

Ongoing authorization requires an approved continuous monitoring strategy and sufficient, near real-time visibility for the AO to conclude that risk remains within tolerance. It does not require a particular impact level, quarterly third-party assessments of all controls, or an empty POA&M.

A significant change is proposed: migrating a system's database tier to a new cloud service provider. Which action best aligns with the RMF Monitor step for handling this change?

Answer: Perform a security impact analysis, determine whether the change affects the authorization boundary or control effectiveness, and re-enter the appropriate RMF steps as needed before or as part of the change

The Monitor step requires an impact analysis for proposed or actual changes. Based on the results, the organization re-enters only the RMF steps needed (for example, Select, Implement, Assess) and updates the authorization package. Automatically restarting at Categorize is unnecessary, deferring updates is noncompliant, and common controls do not waive change analysis.

Two systems share a single boundary-crossing interconnection. System A is categorized High and System B is Moderate. Which approach is most consistent with RMF guidance on managing risk from the interconnection?

Answer: Document the interconnection in both systems' security plans, with an agreement (such as an ISA/MOU) specifying responsibilities, and have each AO accept the risk the connection introduces to their own system

Interconnected systems with different impact levels remain separate authorization boundaries. Each AO must understand and accept risk introduced by the connection, with responsibilities documented in an interconnection agreement and each SSP. Using the lower baseline would expose the High system, merging systems by averaging categorization is invalid, and equal categorization is not required.

A security control assessor finds that a control is implemented but operates differently than described in the SSP, producing the same security outcome. What is the most appropriate RMF-aligned response?

Answer: Document the discrepancy, have the system owner update the SSP to reflect the actual implementation, and evaluate whether the control objective is still met

The SSP must accurately describe the implementation. When the implementation differs but still satisfies the control objective, the appropriate response is to record the discrepancy, correct the SSP, and determine the objective is met. Failing it automatically or forcing reimplementation is disproportionate, and ignoring the discrepancy leaves inaccurate documentation in the authorization package.