Vulnerability Assessment & Testing Flashcards

Which form documents the daily security checks of an area, such as end-of-day closing procedures?

Answer: SF-701 Activity Security Checklist

The SF-701 records end-of-day checks of an area to ensure classified material is secured.

A classified information system's vulnerabilities are primarily reviewed under which process before it can process classified data?

Answer: Assessment and authorization with an authorization to operate (ATO)

Classified systems must be assessed and receive an ATO from the government authorizing official.

Which person has day-to-day responsibility for the security of classified information systems at a cleared contractor?

Answer: ISSM

The Information System Security Manager (ISSM) manages classified system security.

An employee reports finding a classified document left unsecured overnight. What should the FSO do first?

Answer: Secure the material and begin a preliminary inquiry

The FSO secures the material and starts an inquiry to determine whether a compromise occurred.

After a self-inspection identifies deficiencies, what is the best next step?

Answer: Develop and track corrective actions with owners and dates

Documented corrective actions with accountability close the gaps.

Which element must be covered in the contractor's self-inspection under current NISP rules?

Answer: The insider threat program among other program areas

Self-inspections cover the security program broadly, including insider threat program effectiveness.

Who normally performs the formal security review of a cleared facility on behalf of the government?

Answer: DCSA Industrial Security Representative

DCSA ISRs conduct security reviews of cleared contractors.