CGRC Risk Management Framework 2

Question 1

In the NIST RMF, which step involves defining the system boundary and identifying stakeholders responsible for the information system?

Accepted Answer

Prepare

Answer

The Prepare step establishes the context and prerequisites for all subsequent RMF tasks, including defining system boundaries and identifying roles.

Question 2

Which NIST publication provides the catalog of security and privacy controls used in the RMF Select step?

Accepted Answer

NIST SP 800-53

Answer

NIST SP 800-53 provides the catalog of security and privacy controls that organizations select from during the RMF Select step.

Question 3

A system owner wants to accept the residual risk after implementing security controls. Which RMF step does this decision occur in?

Accepted Answer

Authorize

Answer

The Authorize step is where the Authorizing Official (AO) formally accepts residual risk and grants or denies an Authorization to Operate (ATO).

Question 4

What document produced during the RMF Assess step summarizes the results of security control testing?

Accepted Answer

Security Assessment Report (SAR)

Answer

The Security Assessment Report (SAR) documents the assessment methods, findings, and recommendations from the Assess step.

Question 5

Under FISMA, how often must federal systems with an ATO undergo reauthorization if no significant change occurs?

Accepted Answer

Continuous monitoring replaces fixed reauthorization cycles

Answer

NIST SP 800-37 Rev. 2 shifted from fixed 3-year reauthorization cycles to ongoing authorization supported by continuous monitoring.

CGRC - Certified Governance Risk and Compliance Practice Test