ISP Information & Cybersecurity Flashcards

In the NIST Risk Management Framework, during which step does the Authorizing Official accept risk and issue an authorization decision?

Answer: Authorize

The Authorize step is where the AO determines whether residual risk is acceptable and issues an ATO or denial.

What is the primary purpose of a Plan of Action and Milestones (POA&M) for an information system?

Answer: Track identified weaknesses and the planned schedule to remediate them

A POA&M documents vulnerabilities, required corrective actions, resources, and completion dates.

Which document describes a classified system's boundary, environment, and how each required security control is implemented?

Answer: System Security Plan (SSP)

The SSP is the core authorization package document describing the system and its control implementation.

NISPOM insider threat program requirements obligate contractors to implement which capability on classified information systems?

Answer: User activity monitoring

Contractors must be able to monitor user activity on classified IS to detect insider threat indicators.

What is 'periods processing' on a classified information system?

Answer: Processing different classification levels or need-to-know groups at separate times with sanitization between periods

Periods processing separates sessions of differing security requirements with clearing/sanitization procedures between them.

Under the DAAPM, what process is used to move information from a classified system to media of a lower classification level?

Answer: Assured File Transfer

Assured File Transfer (formerly trusted download) uses approved procedures and reviews to prevent spillage when transferring data to lower-level media.

Which federal law requires agencies to develop, document, and implement agency-wide information security programs?

Answer: Federal Information Security Modernization Act (FISMA)

FISMA establishes the federal information security program framework that NIST guidance implements.