Security Assessment Flashcards

During a NIST SP 800-53A assessment of an access control, the assessor keeps the same level of rigor but expands the sample from 5 user accounts on one server to 40 accounts across all production servers, including service and privileged accounts. Which assessment attribute has the assessor increased?

Answer: Coverage

In SP 800-53A, coverage is about the scope and breadth of an assessment: how many objects are assessed and what types they are. Depth is about rigor, detail and thoroughness. Adding more accounts and more account types while keeping the same rigor increases coverage. Depth stays the same, and the method (test or examine) does not change.

An assessor tests a system's boundary protection using partial knowledge of its internal design, such as high-level architecture diagrams and interface specifications, but no source code or detailed implementation documentation. Under SP 800-53A, which depth level does this testing best match?

Answer: Focused

SP 800-53A matches test depth to how much the assessor knows about the system's internals. Basic testing uses no knowledge of internal structure (black-box). Focused testing uses some knowledge, such as high-level design (gray-box). Comprehensive testing uses thorough knowledge, including detailed design and implementation (white-box). Partial design knowledge therefore means focused testing. 'Specific' is not an SP 800-53A depth level.

During the assessment, an assessor marks a configuration management control 'other than satisfied'. The system owner fixes the problem before the Security Assessment Report (SAR) is finalized. Under the RMF Assess step, what is the most appropriate way to handle this?

Answer: Reassess the fixed control and record both the original finding and the reassessment result in the SAR

SP 800-37 (Task A-5) allows initial remediation based on assessment findings, but the assessor must reassess the remediated control. The SAR should record both the original finding and the reassessment result. This keeps the record transparent, so the authorizing official can see where the weakness was and confirm it was independently verified as fixed. Deleting the finding hides history. Relying on the owner's word skips verification.

A common control provider's incident response capability, which 12 systems inherit, is found 'other than satisfied' in the provider's assessment. Which statement best describes how this weakness is handled?

Answer: The common control provider records the weakness in its own POA&M, and each inheriting system's authorizing official considers the resulting risk in their authorization decision

The common control provider is responsible for assessing its common controls, documenting their weaknesses, and keeping its own POA&M. Inheriting systems rely on those assessment results rather than redoing them. Because they inherit the control, its weakness still adds risk to them, so each inheriting system's authorizing official must account for it. The weakness does not stay isolated, and no automatic switch to system-specific controls is required.

An assessor cannot obtain enough evidence to decide whether a determination statement for an audit logging control is met, because the logs the system owner was asked to provide never arrive. Under SP 800-53A, how should this determination statement be recorded?

Answer: Other than satisfied

SP 800-53A allows only two findings for a determination statement: 'satisfied' or 'other than satisfied'. 'Satisfied' requires enough evidence that the statement is met. If the assessor cannot get that evidence, the finding is 'other than satisfied', which flags a possible weakness for the authorizing official. 'Partially satisfied' is not an SP 800-53A finding, and 'not applicable' would wrongly treat a control that applies as if it didn't.

Under NIST SP 800-37 Rev. 2, who reviews and approves the Security and Privacy Assessment Plan before the control assessment starts?

Answer: The authorizing official or designated representative

SP 800-37 Rev. 2 (Task A-3) says the assessment plan is reviewed and approved by the authorizing official or a designated representative. This makes sure the assessment's scope, methods, depth and coverage, and level of independence fit the risk decision the AO will eventually make. The system owner and ISSO have an interest in the outcome, and the assessor carries out the plan rather than approving it.