Information Systems Security and Cybersecurity Basics Flashcards

Which DoD process replaced DIACAP for authorizing information systems?

Answer: Risk Management Framework (RMF)

DoDI 8510.01 adopted the NIST-based Risk Management Framework, replacing DIACAP.

Who formally accepts residual risk and grants an Authorization to Operate (ATO) for a DoD information system?

Answer: The Authorizing Official (AO)

The Authorizing Official is the senior official accountable for accepting risk and issuing the ATO.

Which NIST publication provides the catalog of security and privacy controls used in RMF?

Answer: NIST SP 800-53

NIST SP 800-53 is the control catalog from which RMF baselines are selected.

In RMF, which step assigns an impact level to a system based on the information it processes?

Answer: Categorize

The Categorize step uses CNSSI 1253 and FIPS 199 to set confidentiality, integrity, and availability impact levels.

What is the primary responsibility of an Information System Security Manager (ISSM) at a cleared contractor facility?

Answer: Overseeing the security of classified information systems and their authorization packages

The ISSM manages the facility's classified IS program, including security plans and authorization support.

Which document describes how security controls are implemented for a specific information system?

Answer: System Security Plan (SSP)

The SSP documents the system boundary, environment, and how each control is implemented.

Under RMF, what activity follows authorization to ensure controls remain effective over time?

Answer: Continuous monitoring

The Monitor step provides ongoing assessment of controls and risk after authorization.