ISP Information & Cybersecurity Flashcards

Under 32 CFR Part 117 (NISPOM), which individual must a contractor appoint to oversee the security of its classified information systems?

Answer: Information System Security Manager (ISSM)

32 CFR 117.18 requires contractors processing classified information on information systems to appoint an ISSM responsible for the cybersecurity program.

Which DCSA document provides the procedures contractors follow to obtain authorization for classified information systems?

Answer: DCSA Assessment and Authorization Process Manual (DAAPM)

The DAAPM implements the Risk Management Framework for contractor classified systems under DCSA cognizance.

Who grants the authorization to operate (ATO) for a contractor classified information system under DCSA cognizance?

Answer: The DCSA Authorizing Official

The DCSA Authorizing Official makes the risk-based decision to authorize contractor classified systems.

Which NIST publication provides the catalog of security and privacy controls selected during the Risk Management Framework process?

Answer: NIST SP 800-53

NIST SP 800-53 is the control catalog used to select and tailor baselines in RMF.

Which NIST publication specifies requirements for protecting Controlled Unclassified Information (CUI) on nonfederal contractor systems?

Answer: NIST SP 800-171

NIST SP 800-171 sets the security requirements DFARS 252.204-7012 requires for CUI on contractor systems.

Per NIST SP 800-88, which media sanitization method renders data recovery infeasible even with state-of-the-art laboratory techniques while leaving the media reusable?

Answer: Purge

Purge protects against laboratory attacks while keeping the media usable, unlike Destroy.

Under DFARS 252.204-7012, how quickly must a DoD contractor report a cyber incident affecting covered defense information?

Answer: Within 72 hours of discovery

The clause requires rapid reporting to DoD via the DIBNet portal within 72 hours of discovery.