CSC NIST Risk Management Framework 5

Question 1

What is the relationship between the RMF and the NIST Cybersecurity Framework (CSF)?

Accepted Answer

The RMF is a risk management process while the CSF provides outcomes; RMF tasks can be mapped to CSF functions

Answer

The RMF is a process-oriented risk management lifecycle while the CSF is an outcome-based framework; NIST has published mappings showing how RMF steps align with CSF functions like Identify, Protect, Detect, Respond, and Recover.

Question 2

Under the RMF, what is a 'security authorization boundary'?

Accepted Answer

The defined scope of an information system for which an AO accepts risk

Answer

The authorization boundary defines what resources, components, and data are included within the scope of the security authorization, determining what the ATO covers.

Question 3

An authorizing official reviews an authorization package and determines the residual risk is acceptable. What is the next action?

Accepted Answer

Issue an Authorization to Operate (ATO)

Answer

Once the AO determines residual risk is acceptable, they issue an Authorization to Operate (ATO), formally permitting the system to process information.

Question 4

What is a 'denial of authorization to operate' (DATO) and when is it issued?

Accepted Answer

A temporary suspension issued when a critical vulnerability is discovered that poses unacceptable risk

Answer

A DATO is issued when an AO determines that the risk of operating a system is unacceptable, often due to a critical unmitigated vulnerability, requiring immediate shutdown or remediation.

Question 5

Which NIST publication provides guidance on conducting risk assessments as part of the RMF risk management process?

Accepted Answer

NIST SP 800-30

Answer

NIST SP 800-30 provides the guide for conducting risk assessments, including threat identification, vulnerability analysis, likelihood and impact determinations, and risk determination.

(CSC) Cybersecurity Compliance Certification Practice Test

(CSC) Cybersecurity Compliance Certification Practice Test

CSC NIST Risk Management Framework 5