Risk Management Framework (RMF) Flashcards
6 cards from real CAP practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Risk Management Framework (RMF) flashcards as text
Which RMF step results in the formal decision to authorize a system to operate?
Answer: Authorize
The Authorize step is where the Authorizing Official reviews the risk and formally grants an Authorization to Operate (ATO).
What document serves as the primary contract between the system owner and the Authorizing Official during RMF?
Answer: System Security Plan
The System Security Plan (SSP) describes how security requirements are met and forms the basis for the authorization decision.
In RMF terminology, what is a 'common control'?
Answer: A control inherited by multiple systems from a shared provider
Common controls are security controls that can be inherited by multiple information systems from a centralized provider, reducing duplication.
Which NIST publication provides guidance on security and privacy controls for federal information systems?
Answer: NIST SP 800-53
NIST SP 800-53 provides the catalog of security and privacy controls used during the RMF Select step.
What is the purpose of FIPS 199 in the RMF process?
Answer: Establishing security categorization standards
FIPS 199 establishes standards for categorizing federal information and information systems based on potential impact (low, moderate, high).
The RMF Implement step requires that security controls be implemented in accordance with which document?
Answer: System Security Plan
Controls are implemented as described in the System Security Plan, which documents how each control is satisfied.