Risk Management Framework Flashcards
6 cards from real SFPC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Risk Management Framework flashcards as text
What is the difference between 'risk avoidance' and 'risk acceptance' as risk treatment strategies?
Answer: Risk avoidance eliminates a risky activity or exposure while risk acceptance consciously acknowledges and retains the risk without additional mitigation
Risk avoidance eliminates the risk by not engaging in the risky activity, while risk acceptance means acknowledging the risk and deciding not to take additional mitigation action.
What is a 'security control baseline' in the NIST RMF?
Answer: A predefined set of security controls selected based on system categorization that serves as a starting point for tailoring
A security control baseline is a predefined set of minimum security controls selected based on the system's categorization level, which is then tailored for specific organizational needs.
What is 'risk appetite' in organizational risk management?
Answer: The amount and type of risk an organization is willing to accept in pursuit of its objectives
Risk appetite represents the level and types of risk that an organization is willing to accept as it pursues its mission and objectives.
What is 'inherent risk' versus 'residual risk' in security risk management?
Answer: Inherent risk is the risk level before any controls are applied; residual risk is what remains after controls are implemented
Inherent risk is the raw, unmitigated risk before any controls are applied, while residual risk is the remaining risk level after all security controls and mitigations have been implemented.
What is the role of the 'Authorizing Official' (AO) in the NIST RMF?
Answer: A senior official who has the authority and accountability to accept risk on behalf of the organization and grant ATOs
The AO is a senior official with the authority and accountability to authorize a system to operate by accepting the risk associated with its operation.
What is 'security control assessment' in the NIST RMF?
Answer: An independent evaluation of whether security controls are implemented correctly and operating as intended to produce desired outcomes
Security control assessment is an independent evaluation of the implementation and effectiveness of security controls to determine whether they are working as intended to protect the system.