FedRAMP Security Controls Implementation & NIST SP 800-53 3 — Questions and Answers
Question 1: Which NIST SP 800-53 control requires organizations to develop, document, and periodically update system security plans?
- PL-1: Security Planning Policy and Procedures
- PL-2: System Security Plan (Correct answer)
- CA-2: Security Assessments
- RA-2: Security Categorization
Correct answer: PL-2: System Security Plan
PL-2 (System Security Plan) requires organizations to develop and maintain an SSP covering controls implementation, environment description, and system boundaries.
Question 2: In the context of FedRAMP controls, what does 'Fully Implemented' (FI) mean in the control summary table?
- The control exceeds all FedRAMP requirements
- All aspects of the control are operational and meet FedRAMP requirements (Correct answer)
- The control has been implemented but not yet tested
- The control is implemented only in the production environment
Correct answer: All aspects of the control are operational and meet FedRAMP requirements
Fully Implemented (FI) indicates that all components of the control are deployed, operational, and satisfying the stated requirements at the time of assessment.
Question 3: Which control in NIST SP 800-53 addresses vulnerability scanning requirements?
- SI-2: Flaw Remediation
- RA-5: Vulnerability Monitoring and Scanning (Correct answer)
- CA-8: Penetration Testing
- SI-3: Malicious Code Protection
Correct answer: RA-5: Vulnerability Monitoring and Scanning
RA-5 (Vulnerability Monitoring and Scanning) requires organizations to scan for vulnerabilities in systems and applications at defined frequencies.
Question 4: What is the minimum frequency FedRAMP Moderate baseline requires for vulnerability scanning of operating systems?
- Monthly (Correct answer)
- Quarterly
- Semi-annually
- Annually
Correct answer: Monthly
FedRAMP requires OS/infrastructure vulnerability scanning at least monthly for Moderate impact systems as defined in RA-5 parameter requirements.
Question 5: Which NIST SP 800-53 control family covers incident response planning and execution?
- CP - Contingency Planning
- IR - Incident Response (Correct answer)
- SI - System and Information Integrity
- CA - Security Assessment and Authorization
Correct answer: IR - Incident Response
IR (Incident Response) covers the full incident response lifecycle including preparation, detection, analysis, containment, eradication, and recovery.
Question 6: What does the NIST SP 800-53 SA-9 control primarily address?
- Security awareness training for system administrators
- External information system services and supply chain risk (Correct answer)
- Software assurance and code review requirements
- System and services acquisition planning
Correct answer: External information system services and supply chain risk
SA-9 (External System Services) requires organizations to manage security requirements for third-party services and assess supply chain risks from external providers.
Question 7: Under FedRAMP, which control specifically requires the use of a Plan of Action and Milestones (POA&M) to track security weaknesses?
- CA-5: Plan of Action and Milestones (Correct answer)
- RA-3: Risk Assessment
- PM-4: Plan of Action and Milestones Process
- CA-7: Continuous Monitoring
Correct answer: CA-5: Plan of Action and Milestones
CA-5 (Plan of Action and Milestones) directly requires organizations to develop and maintain a POA&M to document security weaknesses and planned remediation actions.
FedRAMP Security Controls Implementation & NIST SP 800-53 3
Which NIST SP 800-53 control requires organizations to develop, document, and periodically update system security plans?