ISP Information & Cybersecurity Flashcards

Which document formally authorizes a system to operate by accepting identified residual risks?

Answer: Authority to Operate (ATO)

An ATO is an official management decision that a system's risk level is acceptable and it is authorized for operation.

Encryption of data in transit is BEST enforced in an industrial network by requiring:

Answer: Transport Layer Security (TLS) or equivalent cryptographic protocols on all network channels

TLS ensures data integrity and confidentiality while in transit across networks that may traverse untrusted segments.

A 'security baseline' in an industrial information security program refers to:

Answer: The minimum acceptable configuration and security controls applied uniformly to all systems

A security baseline defines the minimum set of controls every system must have, ensuring a consistent security floor across the organization.

Which approach to cybersecurity assumes that no user, device, or network segment should be trusted by default, even inside the perimeter?

Answer: Zero Trust Architecture

Zero Trust operates on the principle of 'never trust, always verify,' requiring continuous authentication and authorization regardless of network location.

Which regulatory framework governs the protection of Controlled Unclassified Information (CUI) in non-federal U.S. industrial organizations?

Answer: NIST SP 800-171 / CMMC

NIST SP 800-171 and its enforcement mechanism CMMC apply to contractors and industrial firms handling CUI on behalf of the U.S. government.

The principle of 'least privilege' in cybersecurity means:

Answer: Giving users only the minimum access rights needed to perform their job functions

Least privilege minimizes the potential damage from accidents, errors, or attacks by limiting what any single account can access or modify.