Section 5: Risk Frameworks

Question 1

NIST SP 800-37 RMF

Answer 1

Risk Management Framework for Information Systems and Organizations
Provides a flexible 7 step process for managing security and privacy risk

Question 2

NIST RMF 7 steps

Answer 2

PREPARE- identify different roles, strategies, control providers
CATEGORIZE- identify all of the organizational assets and categorize them in terms of risk, value, and document them
SELECT- the initial security controls necessary to protect the information system and organization
IMPLEMENT- Deploy security controls and document how they are used
ASSESS- Test the effectiveness of the controls and comply with governance
AUTHORIZE- require a senior management official to take accountability for the residual risk
MONITOR- ongoing evaluation of security effectiveness against organizational and system related changes

Question 3

ISO 31000

Answer 3

Risk management framework that provides a common approach to managing any type of risk within any industry
8 principles

Question 4

ISO 31000 Principles

Answer 4

Integrated
Structured and Comprehensive
Customized
Inclusive
Dynamic
Best Available Information
Human and Cultural Factors
Continual Improvement

Question 5

COSO

Answer 5

Committee of Sponsoring Organizations
Enterprise risk management framework focused on corporate governance
Often used to comply with SOX 404 requirements

Question 6

COSO Components

Answer 6

Governance & Culture
Strategy & Objective Setting
Performance
Review & Revision
Information, Communication & Reporting

Question 7

NIST CSF

Answer 7

NIST Cybersecurity Framework
Risk management and reduction framework based on existing standards, guidelines, and industry best practices
Voluntary and not required by any organization, authorizing, or accrediting body

Question 8

NIST CSF Core

Answer 8

Activities, implementations, and functions designed to achieve the desired cybersecurity outcomes

Question 9

NIST CSF Tiers

Answer 9

Characterize how the core activities align with the desired cybersecurity outcomes
Tier 1 - Partial
Tier 2 - Risk Informed
Tier 3 - Repeatable
Tier 4 - Adaptive

Question 10

NIST CSF Profiles

Answer 10

Alignment of requirements, objectives, implementations, and risk tolerance to the desired cybersecurity outcomes

Question 11

NIST CSF Framework Steps

Answer 11

Identify
Protect
Detect
Respond
Recover