nerdexam
(ISC)2

CGRC · Question #136

Applying the first three steps in the RMF to legacy systems can be viewed in what way to determine if the necessary and sufficient security controls have been appropriately selected and allocated?…

The correct answer is C. Gap analysis. When applying the Risk Management Framework (RMF) to legacy systems, the process of assessing existing security controls against required controls to identify deficiencies is best described as a 'gap analysis.' This helps determine if current controls are sufficient.

Selection and Approval of Framework, Security, and Privacy Controls

Question

Applying the first three steps in the RMF to legacy systems can be viewed in what way to determine if the necessary and sufficient security controls have been appropriately selected and allocated? Response:

Options

  • ASequential
  • BLevel of effort
  • CGap analysis
  • DCommon control

How the community answered

(35 responses)
  • A
    9% (3)
  • B
    3% (1)
  • C
    83% (29)
  • D
    6% (2)

Why each option

When applying the Risk Management Framework (RMF) to legacy systems, the process of assessing existing security controls against required controls to identify deficiencies is best described as a 'gap analysis.' This helps determine if current controls are sufficient.

ASequential

While RMF steps are sequential, viewing the application to legacy systems as a whole specifically to determine control sufficiency is more about identifying discrepancies, not just following steps.

BLevel of effort

'Level of effort' refers to the amount of work required, not the analytical method for determining control sufficiency.

CGap analysisCorrect

For legacy systems, applying the RMF's initial steps (categorize, select, implement) involves evaluating the current state of security against the desired or required state. A 'gap analysis' is the specific method used to identify differences or 'gaps' between what controls are currently in place and what controls are necessary and sufficient for the system's categorization, providing a roadmap for remediation.

DCommon control

'Common control' refers to a security control that is inherited by multiple information systems, not a method for assessing existing controls on a legacy system.

Concept tested: RMF Application to Legacy Systems - Gap Analysis

Source: https://csrc.nist.gov/glossary/term/gap_analysis

Topics

#RMF#Legacy Systems#Gap Analysis#Security Controls Selection

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CGRC Practice