Which of the following documents were developed by NIST for conducting Certification & Accreditation (C&A)? Each correct answer represents a complete solution. Choose all that apply.

Question

Options

• ANIST Special Publication 800-53A
• BNIST Special Publication 800-37A
• CNIST Special Publication 800-59
• DNIST Special Publication 800-53
• ENIST Special Publication 800-37
• FNIST Special Publication 800-60

• A
  91% (30)
• B
  9% (3)

Explanation

NIST developed a suite of publications specifically to guide the Certification & Accreditation (C&A) process for federal information systems. NIST SP 800-37 provides the guide for applying the Risk Management Framework (the core C&A process). NIST SP 800-53 defines the security and privacy controls that systems must implement. NIST SP 800-53A provides the methodology for assessing those controls. NIST SP 800-59 gives guidance on identifying whether a system qualifies as a National Security System. NIST SP 800-60 maps information types to security impact categories, which feeds into the categorization step of C&A. Option B (800-37A) is a distractor - it does not exist as a real NIST publication. All five valid documents (A, C, D, E, F) form an integrated framework used throughout the C&A lifecycle.

No community discussion yet for this question.