Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CAP > RMF Step 2: Select > Flashcards

RMF Step 2: Select Flashcards

1
Q

RMF Task 2-1

A

Identify security controls that are common controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

RMF Task 2-2

A

Select the security controls for the information system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

RMF Task 2-3

A

Develop a strategy for continuous monitoring of controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Security Controls

A

Management, Operational, and Technical controls designated to information system to protect CIA. Made up of safeguards and countermeasures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Safeguards

A

Protective measures prescribed to meet the security requirements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Countermeasures

A

Actions that reduce the vulnerability of a system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Minimum Security Baseline

A

set of standards that applied enterprise wide to ensure consistent level of compliance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Two documents that govern Step 2 selection of security controls are

A

FIPs 200 and NIST 800-53 (Security and Privacy Controls for information systems)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

How many control families are there?

A

17, with one additional family control (PM controls, program mgmt)

and privacy controls

but makes a total of 18

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

High water mark

A

used to identify the system category and baseline security controls to implement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

NIST 800-53 no longer divides families into what?

A

Mgmt, operational, technical controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are the 18 control families

AC
AT
AU 
CA
CM
CP
IA
IR
MA
MP
PE 
PL
PS
RA
SA
SC
SI 
PM
A 
AC
AT
AU - audit and accountability
CA - Security Assessment and Authorization
CM
CP
IA - identification and authentication
IR
MA
MP
PE - physical and environment protection
PL
PS
RA
SA - System and Services Acquisition
SC - System and Communications Protection
SI - System and Information Integrity
PM - Program mgmt
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Information Security Programs - PM Controls

A
  • Organization wide information security program management controls
  • Not associated with security control baselines
  • Independent of any system impact level, no control enhancements
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Privacy Controls - Define and how many control families

A
  • Safeguards employed to protect and ensure proper handling of PII
  • Split into 8 families
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Privacy Controls

AP
AR
DI
DM
IP
SE
TR
UL
A 
AP - Authority and purpose
AR - Accountability, Audit, and Risk Mgmt
DI - Data Quality and Integrity
DM - Data Minimization and Retention
IP - Individual Participation and Redress
SE - Security
TR - Transparency 
UL - Use Limitation
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Privacy Controls - AP and AR Controls

A

AP - Authority and Purpose
*authority of PII, purpose of PII

AR - Accountability, Audit, and Risk Mgmt
*ensure compliance with privacy protection requirements and minimizing overall privacy risk

17
Q

Privacy Controls - DI and DM

A

DI - Data Quality and Integrity
*ensure PII is accurate

DM - Data Minimization and Retention
*ensures retaining PII that is necessary or relevant

18
Q

Privacy Controls - IP and SE

A

IP - Individual Participation and Redress
*Individuals made aware of the collection and use of their PII

SE - Security
*ensure safeguards are in place to protect PII collected against loss or unauthorized access and ensure compliance with OMB policies and guidance

19
Q

Privacy Controls - TR and UL

A

TR - Transparency
*ensures organizations provide public notice of their practices and privacy impact of their programs and activities

UL - Use Limitation
*Ensure use of PII only as specified in their public notices

20
Q

NIST 800-53 Control Section

A

concise statement of specific security capabilities needed to protect information system (definition of control)

21
Q

NIST 800-53 Supplemental Guidance Section

A

provides additional info related to a specific control, but contains no requirements

22
Q

NIST 800-53 Control Enhancements Section

A

provides statements of security capability to

1) build additional functionality to a control
2) increase the strength of the control

23
Q

NIST 800-53 References Section

A

a list of applicable federal laws, executive orders, directives, policies, standards, and guidelines that are relevant to a control or enhancement

24
Q

NIST 800-53 Priority and Baseline Allocation Section

A

1) The recommended priority codes used in sequencing decisions during security control implementation
2) initial allocation of controls and enhancements for low, mod, high impact systems

Priority Code 1 (P1) - FIRST - implement first
P2 - NEXT
P3 - LAST
P0 - NONE - control not selected for baseline

25
Q

Common Controls and their benefits

A

Controls that can be allocated to one or more information systems

Benefits - major savings in development and implementation costs, reliable application to multiple systems

26
Q

Input/Output for RMF Step 2: Select

A

Inputs

  • System description
  • Security cateogry
  • Impact level
  • NIST 800-53
  • Common Controls

Output
*Final, agreed upon set of security controls

CAP (13 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions