Risk Management Framework Flashcards

A federal agency needs to test a new system in its operational environment, with live data, for 60 days before it makes a full authorization decision. Assessments are not complete and the authorization package is still being written. Under NIST SP 800-37 Rev. 2, which authorization approach fits this situation?

Answer: An interim authorization to test (IATT), granted by the authorizing official for a specified time period

An IATT is a special type of authorization. It lets a system be tested in an operational environment, with live data, for a specified time period. Only the authorizing official can grant it, and it carries risk that the AO must accept. It does not turn into an ATO automatically. A full authorization decision is still needed after the RMF steps are finished. An ATU is used to accept another organization's existing authorization package, and a system owner cannot issue authorizations at all.

An agency wants to use a SaaS offering that already has an authorization package produced by another federal organization. The agency's authorizing official reviews that package and decides the risk is acceptable. Which authorization decision best describes what the agency's AO issues?

Answer: An authorization to use (ATU), which accepts the existing package and the risk of using the system or service

SP 800-37 Rev. 2 defines an authorization to use (ATU) for cases where an organization accepts an authorization package already produced by another organization, such as a shared or cloud service. The consuming AO accepts the risk of using the system or service; the other organization stays responsible for the system's original authorization. A joint authorization means several AOs authorize the same system together. A type authorization covers identical copies of one system deployed in different locations. A 'reciprocal ATO' that transfers accountability is not an RMF construct.

A defense contractor builds a hardened sensor platform. Identical copies (same hardware, software and configuration) will be deployed to 40 locations. Separately, one of those locations is a data center that provides physical and environmental protections, and many unrelated systems will be placed there. Which pair of authorization approaches matches these two needs most precisely?

Answer: Type authorization for the sensor platform; facility authorization for the data center's common controls

A type authorization covers one system that is deployed as identical copies to several locations, so the sensor platform fits it. A facility authorization authorizes the common controls that a specific environment (such as a data center) provides to the systems placed there. Those systems then inherit the controls and do not each re-authorize them. Option A reverses the two terms, which is a common mistake. Separate ATOs for each sensor would be redundant, and an ATU accepts another organization's package.

System X inherits an organization-wide audit logging service, which is a common control. During System X's control assessment, the assessor finds that the logging service does not keep logs for the required period. Under RMF, who is primarily responsible for documenting and fixing this deficiency?

Answer: The common control provider, who records it in the common control POA&M and remediates it; the System X owner and AO consider the residual risk to System X

Common control providers are responsible for implementing, assessing and maintaining the controls they offer. That includes tracking deficiencies in a POA&M and fixing them. Systems that inherit a deficient common control do not fix it themselves. Instead, the System X owner and AO must understand and account for the resulting risk to their system, for example by noting it in the risk assessment or adding system-specific measures. Assessors find and report weaknesses; they do not fix controls.

An agency wants to move a moderate-impact system from a three-year reauthorization cycle to ongoing authorization. Which condition is the essential prerequisite under SP 800-37 Rev. 2?

Answer: The system has an initial authorization, and an information security continuous monitoring (ISCM) program gives the AO timely, relevant security and privacy information at the frequency the organization has set

Ongoing authorization needs two things. First, the system must have an initial authorization. Second, a robust continuous monitoring program must keep providing the AO with current information about the system's security and privacy posture, so the AO can decide on an ongoing basis whether the risk is still acceptable. Reauthorization is then driven by time-driven and event-driven triggers instead of a fixed termination date. Ongoing authorization is not limited to low-impact systems, does not require a full annual reassessment, and does not have a short fixed termination date.

During the Assess step, a program manager says the control assessor should come from the system development team because that team knows the system best. According to RMF, who determines the level of assessor independence the assessment requires?

Answer: The authorizing official, based on factors such as the system's impact level and the organization's risk tolerance

Under SP 800-37 Rev. 2, the authorizing official (or the AO's designated representative) decides how independent the assessor must be. The decision is based on risk: the system's impact level, the criticality of its mission and business functions, and how far the AO needs to trust the results. Full independence is not required for every system. The system owner has a conflict of interest and should not set this level. The CIO does not set it as a blanket rule either.