Risk Management Framework Flashcards
6 cards from real SFPC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Risk Management Framework flashcards as text
What is the primary purpose of the NIST Risk Management Framework (RMF)?
Answer: To provide a structured process for integrating security and privacy risk management into the system development lifecycle
The NIST RMF provides a comprehensive process for managing information security and privacy risk throughout the system development lifecycle, from design through decommission.
What is 'system categorization' in the NIST RMF?
Answer: Determining the impact level of a system based on the sensitivity of the information it processes and the potential impact of a security breach
System categorization assigns an impact level (Low, Moderate, or High) based on the potential impact to the organization if the system's confidentiality, integrity, or availability were compromised.
What is an 'authorization boundary' in the context of the NIST RMF?
Answer: The defined scope of what is included in a system for security authorization purposes
The authorization boundary defines the scope of what components and elements are included within a system and subject to the security authorization under the RMF.
What is a 'Plan of Action and Milestones' (POA&M) in the RMF context?
Answer: A document identifying security weaknesses in a system with planned remediation actions and target completion dates
A POA&M documents identified security weaknesses, the planned actions to address them, the resources required, and target completion dates for remediation.
What is the 'continuous monitoring' step in the NIST RMF designed to accomplish?
Answer: Maintaining ongoing awareness of the security posture of a system to support risk management decisions
Continuous monitoring maintains ongoing situational awareness of system security, enabling rapid detection of changes that may introduce new risks and supporting informed authorization decisions.
What is an 'Authority to Operate' (ATO) in the RMF process?
Answer: An official management decision granting permission to operate an information system at an acceptable level of risk
An ATO is the official authorization from a senior official granting permission to operate an information system, based on an assessment that the risk to organizational operations is acceptable.