Risk Management Framework Flashcards
6 cards from real CAP practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Risk Management Framework flashcards as text
Which NIST publication provides the primary guidance for the Risk Management Framework (RMF) used in CAP?
Answer: NIST SP 800-37
NIST SP 800-37 provides the foundational guidance for the Risk Management Framework used across federal systems.
What is the correct order of the first three steps in the NIST RMF?
Answer: Prepare, Categorize, Select
The RMF begins with Prepare, then Categorize, then Select controls before implementation.
Which RMF step involves choosing security controls from NIST SP 800-53?
Answer: Select
The Select step involves choosing appropriate security controls tailored to the system's risk profile.
What document formally records the selected security controls for an information system during the RMF?
Answer: System Security Plan (SSP)
The System Security Plan documents the security controls selected and implemented for the system.
In the RMF, which step involves the Authorizing Official making an accept/reject risk decision?
Answer: Authorize
The Authorize step is where the AO reviews the risk assessment package and decides to grant or deny an ATO.
Which NIST publication provides guidance on security and privacy controls referenced during the RMF Select step?
Answer: NIST SP 800-53
NIST SP 800-53 is the catalog of security and privacy controls used during the Select step of the RMF.