CSC NIST Risk Management Framework 2

Question 1

Which RMF step is responsible for selecting the initial set of security controls based on the system's impact level?

Accepted Answer

Select

Answer

The Select step involves choosing appropriate security controls from NIST SP 800-53 based on the system categorization and impact level.

Question 2

What document formally records the security controls selected for an information system and their implementation status?

Accepted Answer

System Security Plan (SSP)

Answer

The System Security Plan (SSP) documents the selected controls, their implementation details, and the system's security posture.

Question 3

In the RMF Assess step, who typically conducts the security control assessment?

Accepted Answer

An independent assessor or assessment team

Answer

NIST requires that assessors be independent from the system development team to ensure objectivity and avoid conflicts of interest.

Question 4

What is the primary output of the RMF Assess step?

Accepted Answer

Security Assessment Report (SAR)

Answer

The Security Assessment Report (SAR) documents the findings from the security control assessment, including deficiencies and recommendations.

Question 5

Which NIST publication provides the catalog of security and privacy controls used during the RMF Select step?

Accepted Answer

NIST SP 800-53

Answer

NIST SP 800-53 provides the comprehensive catalog of security and privacy controls that organizations select from during the RMF Select step.

(CSC) Cybersecurity Compliance Certification Practice Test