A security engineer is a new member to a configuration board at the request of management. The company has two new major IT projects starting this year and wants to plan security into the…

The NIST RMF requires selecting and establishing a security control baseline (Step 2 - Select) before controls can be assessed (Step 4 - Assess). By jumping directly to performing a security assessment, the engineer omitted the critical baseline-establishment step, which defines what controls must be in place and provides the standard against which the assessment is measured.

While building the application securely is important, it is the responsibility of developers, not the security assessor; the engineer's defined role is assessment only, so omitting development oversight is not the gap.

Reviewing user acceptance testing results is a quality assurance activity outside the scope of a federal security assessment and authorization process, so this is not a step the security engineer would be expected to perform.

Consulting stakeholders to omit standards is not a valid step in federal assessment and authorization; applicable standards are determined by system categorization and cannot be arbitrarily waived by stakeholders.