National Institute of Standards Technology (NIST)

Question 1

NIST

Answer 1

Founded in 1901 as an agency within the US Commerce Department’s Technology Administration, NIST develops standards and guidelines for use with federal computer systems government wide.

Question 2

The NIST document are available within what clusters ?

Answer 2

 FIPS Publications
 Special Publications (SP)
 Interagency Reports (IR)
 Information Technology Laboratory (ITL)
 Security Bulletins

Question 3

The below parts for NIST Framework is used for
 The Framework Core
 The Framework Profile
 The Framework Implementation Tiers

Answer 3

Providing high level taxonomy of cybersecurity outcomes and methodology for access and management of the outcome

Question 4

NIST framework relies upon effective risk management and can use many standard risk management methodologies, such as

Answer 4

ISO 31000, ISO 27005 or NIST SP800-39.

Question 5

What are the core functions of NIST framework

Answer 5

 Identify – develop the organisational understanding to manage cyber security risk to systems, applications, and data
 Protect – implement safeguards to ensure the secure delivery of infrastructure services
 Detect – implement the appropriate activities to take action on a cyber security event
 Respond – develop & implement appropriate activities to take action regarding a detected cyber security event
 Recover – maintains plans for resilience and to restore any services impacted by a cyber security event

Question 6

What are the 4 tiers to characterise the ‘current state’ of an organisation’s cybersecurity practices

Answer 6

 Tier 1 (Partial): Informal cybersecurity risk management practices; ad hoc and reactive approach to risk management.
 Tier 2 (Risk Informed): Management-approved risk management processes, awareness of risk at organisational level, but lack of organisation-wide approach.
 Tier (Repeatable): Risk management processes expressed as policy, organisation-wide approach to manage cybersecurity risk, risk informed policies, processes and procedures.
 Tier 4 (Adaptive): Adaptable cybersecurity practices based on lessons learnt and predictive indicators, continuous improvement incorporating advanced technologies and practices, active sharing of
information with partners both before and after cyber security events.

Question 7

What is the meaning of FIPS

Answer 7

Federal Information Processing Standards

Question 8

FIPS Publications are issued by NIST after approval by

Answer 8

The Secretary of Commerce

Question 9

FIPS 140-2 is for the

Answer 9

Security requirements for cryptographic modules

Question 10

FIPS 197 is for

Answer 10

Advanced Encryption Standard (AES)