Security Assessment Flashcards

An assessor is preparing a security assessment plan using NIST SP 800-53A for a high-impact system. To get more assurance, the plan expands the test from a sample of 5 servers to all 60 servers and adds the backup and DR sites. Under SP 800-53A, which assessment attribute has been increased?

Answer: Coverage, because the number and types of assessment objects have increased

SP 800-53A defines two attributes for each assessment method (examine, interview, test). Coverage is the scope or breadth: how many objects are assessed and what types. Depth is the rigor and level of detail: how thoroughly each object is examined or tested. Adding servers and sites increases coverage, not depth. 'Rigor' and 'independence' are not the SP 800-53A names for method attributes.

An SP 800-53A assessment objective has four determination statements. The assessor finds that three are fully met and the fourth is only partly met because one of five required log sources is not forwarded to the SIEM. How should the assessor record the finding for that objective?

Answer: Other than satisfied, with the specific weakness described

SP 800-53A allows only two findings for a determination statement: 'satisfied' or 'other than satisfied.' There is no 'partially satisfied' finding. If any part of the objective is not fully met, the finding is 'other than satisfied,' and the assessor describes the specific weakness, such as the missing log source. Risk analysts and the AO then use that description to judge how severe the weakness is.

In NIST SP 800-37 Rev. 2, which role decides what level of independence is required for the control assessors of a given system?

Answer: The authorizing official or designated representative, based on the risk to operations and assets

SP 800-37 Rev. 2 states that the authorizing official (or designated representative) determines the required level of assessor independence. The AO is the one accepting the risk, so the AO must be confident that the results are credible and unbiased enough to support the authorization decision. The system owner should not choose this because it creates a conflict of interest. Assessors must report conflicts, but they do not set the independence requirement.

A system's assessor finds a weakness in an inherited common control: the enterprise identity service's account lockout threshold is set incorrectly. Which response best follows RMF practice?

Answer: The weakness is reported to the common control provider, who tracks remediation in its own POA&M. The system owner considers the residual risk in the system's authorization package.

The common control provider is responsible for implementing, assessing, and remediating common controls, and tracks their weaknesses in its own POA&M. Systems that inherit a deficient common control still carry that risk, so the system owner must report it in the system's authorization package and may add compensating or system-specific measures. The system owner does not usually have authority to change the enterprise service directly. Marking the control 'not applicable' would hide real risk.

After receiving the draft security assessment report, the system owner disagrees with a finding and believes the assessor misread the configuration evidence. What is the appropriate RMF way for the system owner to respond?

Answer: Give the assessor additional evidence. If the disagreement remains, add an addendum to the assessment report explaining the owner's position, without changing the assessor's findings.

SP 800-37 Rev. 2 lets system owners and common control providers respond to assessment findings by adding an addendum to the assessment report. The addendum can include clarifying evidence, rationale, or remediation actions already taken. The assessor's findings remain the assessor's, which protects the integrity and independence of the assessment. The AO sees both the findings and the owner's response. Editing the SAR, closing the item without fixing it, or replacing the assessor all undermine the assessment's credibility.

An agency wants to reuse control assessment results from a third-party assessment done 11 months ago to support a new authorization. According to SP 800-53A guidance on reusing assessment results, which consideration matters MOST?

Answer: Whether the system, its controls, or its threat environment have changed since the original assessment, and whether that assessment's scope, rigor, and independence meet the current need

SP 800-53A allows reuse of previous assessment results when they are still credible and relevant. The main factors are changes to the system, its controls, or its environment since the assessment; how much time has passed relative to how often the control changes; and whether the original assessment's scope, rigor, and assessor independence are good enough for the current decision. No rule makes results automatically valid for 12 months. Vendor lists and report templates are administrative details that do not show the results are still valid.