CSC NIST Risk Management Framework 5

Question 1

What is the relationship between the RMF and the NIST Cybersecurity Framework (CSF)?

Accepted Answer

The RMF is a risk management process while the CSF provides outcomes; RMF tasks can be mapped to CSF functions

Answer

They are identical frameworks with different names

Answer

The CSF replaces the RMF for federal agencies

Answer

The CSF is mandatory while the RMF is voluntary

Question 2

Under the RMF, what is a 'security authorization boundary'?

Accepted Answer

The defined scope of an information system for which an AO accepts risk

Answer

A firewall rule separating internal and external networks

Answer

The perimeter of a data center facility

Answer

The list of IP addresses covered by a vulnerability scan

Question 3

An authorizing official reviews an authorization package and determines the residual risk is acceptable. What is the next action?

Accepted Answer

Issue an Authorization to Operate (ATO)

Answer

Conduct an additional security assessment

Answer

Update the System Security Plan

Answer

Escalate to the Chief Information Security Officer

Question 4

What is a 'denial of authorization to operate' (DATO) and when is it issued?

Accepted Answer

A temporary suspension issued when a critical vulnerability is discovered that poses unacceptable risk

Answer

A permanent ban on operating any information system

Answer

A denial issued when a system fails a penetration test

Answer

A notice that the ATO application was incomplete

Question 5

Which NIST publication provides guidance on conducting risk assessments as part of the RMF risk management process?

Accepted Answer

NIST SP 800-30

Answer

NIST SP 800-53

Answer

NIST SP 800-37

Answer

FIPS 140-2

Question 6

In the RMF, what is the significance of the 'authorization package'?

Accepted Answer

It is a collection of key documents (SSP, SAR, POA&M) submitted to the AO to support the authorization decision

Answer

It contains only the System Security Plan

Answer

It is the contract between the organization and a cloud provider

Answer

It is issued by NIST to certify a product meets security standards

Question 7

How does supply chain risk management (SCRM) integrate into the RMF under NIST SP 800-161?

Accepted Answer

SCRM controls are incorporated into the RMF by applying supply chain-specific controls during the Select and Implement steps

Answer

SCRM is handled separately and has no connection to the RMF

Answer

SCRM replaces the Categorize step for systems using third-party components

Answer

SCRM only applies to hardware procurement, not software