CGRC Risk Management Framework 3

Question 1

An organization operates a cloud-hosted system and wants to leverage an existing FedRAMP authorization. Which RMF concept supports reusing another system's security authorization package?

Accepted Answer

Reciprocity

Answer

Reciprocity allows organizations to accept an existing authorization package rather than duplicating assessment efforts, reducing redundancy.

Question 2

What is the purpose of a Plan of Action and Milestones (POA&M) in the RMF?

Accepted Answer

To track remediation of identified security weaknesses

Answer

The POA&M is a corrective action plan that tracks identified vulnerabilities and weaknesses, their remediation status, and target completion dates.

Question 3

When applying the RMF, what does 'tailoring' security controls mean?

Accepted Answer

Adding, removing, or modifying controls from a baseline to fit the system's environment

Answer

Tailoring allows organizations to adjust the control baseline by adding compensating controls, scoping controls, or applying parameter values appropriate to their risk environment.

Question 4

In the NIST RMF, which document serves as the primary artifact describing the security posture of an information system?

Accepted Answer

System Security Plan (SSP)

Answer

The System Security Plan (SSP) describes the system environment, security requirements, and the controls in place or planned to protect the system.

Question 5

Which NIST publication guides how to categorize federal information and information systems for security purposes?

Accepted Answer

FIPS 199 and NIST SP 800-60

Answer

FIPS 199 defines the standards for categorization, and NIST SP 800-60 maps information types to security impact levels for use during the Categorize step.

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC Risk Management Framework 3