25. NIST 800-37 Rev 1 & 2

Question 1

NIST 800-37 Rev 1 & 2

Tier 1:
Organisation

Answer 1

3 TIER RISK MGMT APPROACH

Question 2

NIST 800-37 Rev 1 & 2

Tier 2:
Mission / Business Processes

Answer 2

3 TIER RISK MGMT APPROACH

Question 3

NIST 800-37 Rev 1 & 2

Tier 3:
Information Systems

Answer 3

• NIST 800-53 is found at Tier 3
• 6 step process for risk management lifecycle

3 TIER RISK MGMT APPROACH

Question 4

NIST 800-37 Rev 1 & 2

7 major objectives updated in Rev 2.

Answer 4

1. Provide closer linkage between risk management process and activities of C-suite
2. Institutionalise critical risk management all risk management levels
3. Demonstrate how NIST CSF can be aligned with RMF
4. Integrate privacy risk management processes
5. Promote/Develop trustworthy secure software and systems
6. Integrate security-related supply chain risk management (SCRM)
7. Organisation generated control selection approach to traditional baseline control selection

Question 5

NIST 800-37 Rev 1 & 2

To provide closer linkage and communication between the risk management processes and activities at the C-suite

7 major objectives updated in Rev 2

Answer 5

1. Senior Management Supports Initiative
2. 2 way communication

Question 6

NIST 800-37 Rev 1 & 2

To institutionalize critical risk management preparatory activities at all risk management levels.

7 major objectives updated in Rev 2

Question 7

NIST 800-37 Rev 1 & 2

To demonstrate how the NIST Cybersecurity Framework [NIST CSF] can be aligned with the RMF and implemented using established NIST risk management processes

7 major objectives updated in Rev 2

Answer 7

Provides Defense in Depth

Question 8

NIST 800-37 Rev 1 & 2

To integrate privacy risk management processes into the RMF to better support the privacy protection needs for which privacy programs are responsible

7 major objectives updated in Rev 2

Question 9

NIST 800-37 Rev 1 & 2

To promote the development of trustworthy secure software and systems

7 major objectives updated in Rev 2

Question 10

NIST 800-37 Rev 1 & 2

To integrate security-related, supply chain risk management (SCRM) concepts into the RMF

7 major objectives updated in Rev 2

Answer 10

Supply Chain Management is critical

• plans in place for mitigation i.e. when Datacenter breaks
• How to get back to normal operations
• Ensure redundancy for the things we need

Question 11

NIST 800-37 Rev 1 & 2

To allow for an organization-generated control selection approach to complement the traditional baseline control selection approach and support the use of the consolidated control catalog in NIST Special Publication 800-53, Revision 5

7 major objectives updated in Rev 2

Answer 11

Make risk management processes more efficient, more effective, more cost effective

• Implement security in design
• Privacy requirements are in initial design i.e. SDLC

Question 12

NIST 800-37 Rev 1 & 2

Cyber Security Framework

Answer 12

Ties all connecting frameworks / applications together