DODI 8510.01, RISK MANAGEMENT FRAMEWORK (RMF) FOR DOD INFORMATION TECHNOLOGY (IT) Flashcards
Which approach to cybersecurity risk management as described in NIST SP 800-39 is implemented by the DoD RMF governance structure?
Three-tiered
Which Tier level in RMF addresses risk management at the DoD enterprise level?
Tier 1
Who directs and oversees the cybersecurity risk management of DoD IT?
Department of Defense Chief Information Officer (DoD CIO)
What performs the DoD Risk Executive Function?
DoD Information Security Risk Management Committee (ISRMC)
What is the community forum for reviewing and resolving authorization issues related to the sharing of community risk?
Defense IA Security Accreditation Working Group (DSAWG)
Who oversees the RMF TAG and the online KS?
Department of Defense Senior Information Security Officer (DoD SISO)
What provides implementation guidance for the RMF by interfacing with the DoD component cybersecurity programs, cybersecurity communities of interest (COIs), and other entities to address issues that are common across all entities?
Risk Management Framework Technical Advisory Group (RMF TAG)
What supports RMF implementation, planning, and execution by functioning as the authoritative source for RMF procedures and guidance?
Knowledge Service
Who must monitor and track overall execution of system-level POA&Ms?
Authorizing Officials
Who develops, maintains, and tracks security plans for assigned IS and PIT systems?
Information System Owners (ISOs)
PMs must ensure periodic reviews, testing and assessment of assigned IS and PIT systems are conducted at least how often?
Annually
PMs must ensure T&E of assigned IS and IT systems is planned, resourced, and documented in the program T&E master plan in accordance with which reference?
DoDI 5000.02
What reduces redundant testing, assessing and documentation, and the associated cost in time and resources?
Reciprocity
What must PMs and ISOs who are deploying systems across DoD Components post security authorization documentation to in order to provide visibility of authorization status and documentation to planned receiving sites?
Enterprise Mission Assurance Support Service (eMASS)
Which reference contains DoD policy for Unified Capabilities (UC)?
DoDI 8100.04
What is used to deploy identical copies of an IS or PIT system in specified environments?
Type authorization
Which type of systems do not transmit, receive, route, or exchange information outside of the system’s authorizations?
3
What must all DoD IS and PIT systems have that provides an overview of the security requirements for the system and describes the security controls in place or planned for meeting those requirements?
Security plan
How many steps are in the RMF process?
6
What is step one of the RMF process?
Categorize system
What is step two of the RMF process?
Select Security Controls
What is step three of the RMF process?
Implement Security Controls
What is step four of the RMF process?
Assess Security Controls
What is step five of the RMF process?
Authorize System
What is the final step of the RMF process?
Monitor Security Controls
RMF Team members are required to meet the suitability and fitness requirements established in which reference?
DoD 5200.2-R
What is the authoritative source for detailed security control descriptions, implementation guidance and assessment procedures?
Knowledge Service
Which reference identifies vulnerability severity values?
NIST SP 800-30
Who determines and documents in the SAR a risk level for every NC security control in the system baseline?
Security Control Assessor (SCA)
What is used to document the SCA’s findings of compliance with assigned security controls based on actual assessment results?
Security Assessment Report (SAR)
What is used to identify tasks that need to be accomplished to remediate or mitigate vulnerabilities?
POA&M
IATTs should be granted only when an operational environment or live data is required to complete specific test objectives and should expire at the completion of testing (normally for a period of less than how many days)?
90
Who continuously monitors the system or information environment for security-relevant events and configuration changes that negatively affect security posture?
Information Systems Security Manager (ISSM)
