FedRAMP Security Controls Implementation & NIST SP 800-53 3

Question 1

Which NIST SP 800-53 control requires organizations to develop, document, and periodically update system security plans?

Accepted Answer

PL-2: System Security Plan

Answer

PL-1: Security Planning Policy and Procedures

Answer

CA-2: Security Assessments

Answer

RA-2: Security Categorization

Question 2

In the context of FedRAMP controls, what does 'Fully Implemented' (FI) mean in the control summary table?

Accepted Answer

All aspects of the control are operational and meet FedRAMP requirements

Answer

The control exceeds all FedRAMP requirements

Answer

The control has been implemented but not yet tested

Answer

The control is implemented only in the production environment

Question 3

Which control in NIST SP 800-53 addresses vulnerability scanning requirements?

Accepted Answer

RA-5: Vulnerability Monitoring and Scanning

Answer

SI-2: Flaw Remediation

Answer

CA-8: Penetration Testing

Answer

SI-3: Malicious Code Protection

Question 4

What is the minimum frequency FedRAMP Moderate baseline requires for vulnerability scanning of operating systems?

Accepted Answer

Monthly

Answer

Quarterly

Answer

Semi-annually

Answer

Annually

Question 5

Which NIST SP 800-53 control family covers incident response planning and execution?

Accepted Answer

IR - Incident Response

Answer

CP - Contingency Planning

Answer

SI - System and Information Integrity

Answer

CA - Security Assessment and Authorization

Question 6

What does the NIST SP 800-53 SA-9 control primarily address?

Accepted Answer

External information system services and supply chain risk

Answer

Security awareness training for system administrators

Answer

Software assurance and code review requirements

Answer

System and services acquisition planning

Question 7

Under FedRAMP, which control specifically requires the use of a Plan of Action and Milestones (POA&M) to track security weaknesses?

Accepted Answer

CA-5: Plan of Action and Milestones

Answer

RA-3: Risk Assessment

Answer

PM-4: Plan of Action and Milestones Process

Answer

CA-7: Continuous Monitoring