RMF Step 5: Authorize

Question 1

RMF Task 5-1

Answer 1

Prepare the POA&Ms based on findings and recommendations of SAR

Question 2

RMF Task 5-2

Answer 2

Assemble security authorization package and submit the package to AO

Question 3

RMF Task 5-3

Answer 3

Determine risk to operations

Question 4

RMF Task 5-4

Answer 4

Determine if risk is acceptable

Question 5

Guidance

Answer 5

SP 800-37 - RMF

Question 6

Security Authorization Package includes

Answer 6

SSP
SAR
POA&M

Question 7

Risk Assessment

Answer 7

A risk assessment involves the systematic identification and prioritization of risks to resources

Question 8

Assess Risk - Analysis includes …

Answer 8

1) identification of threats
2) assessment of vulnerabilities in controls
3) Calculation of risks

Question 9

Guidance

Answer 9

NIST 800-30 rev 1: guide for conducting risk assessments

Question 10

NIST 800-30: Guide for conducting risks STEPS

Answer 10

1) Prepare for assessment
2) Conduct the assessment
* Identify threat
* Identify vulnerability
* determine likelihood of occurrence
* determine impact
* determine risk
3) communication results
4) maintain assessment
* monitor AORs

Question 11

2 FACTORS FOR DETERMINING RISK

Answer 11

LEVEL OF IMPACT AND LIKELIHOOD

Question 12

Types of responses to risks

Answer 12

1) Accept & continue operatin
2) Transfer/Share to 3rd party
3) Mitigate - change assets
4) avoid - eliminate assets

Question 13

Authorization Decisions

Answer 13

1) ATO (up to 3 years)
2) Denial of ATO
3) Interim ATO (iATO)

Question 14

INPUTS AND OUTPUTS OF RMF STEP 5: AUTHORIZE

Answer 14

INPUTS

• Security Authorization Package (SSP, POA&M, SAR)
• input from risk executive
• other artifacts

OUTPUTS
*AO Decision Document