nerdexam
(ISC)2

CGRC · Question #164

Which NIST publication is the Guide to applying RMF in Federal Info Systems a Security Life cycle approach & moved process from four phase certification & accreditation approach to emphasis risk…

The correct answer is A. NIST SP 800-37. NIST SP 800-37 is the authoritative guide for applying the Risk Management Framework (RMF) to federal information systems, transitioning from a previous four-phase approach to a six-step risk-based authorization process. It outlines the holistic lifecycle approach to managing…

Security and Privacy Governance, Risk Management, and Compliance Program

Question

Which NIST publication is the Guide to applying RMF in Federal Info Systems a Security Life cycle approach & moved process from four phase certification & accreditation approach to emphasis risk management in a 6 step authorization process. Response:

Options

  • ANIST SP 800-37
  • BNIST SP 800-39
  • CNIST SP 800-53
  • DNIST SP 800-40

How the community answered

(56 responses)
  • A
    91% (51)
  • B
    2% (1)
  • C
    5% (3)
  • D
    2% (1)

Why each option

NIST SP 800-37 is the authoritative guide for applying the Risk Management Framework (RMF) to federal information systems, transitioning from a previous four-phase approach to a six-step risk-based authorization process. It outlines the holistic lifecycle approach to managing security and privacy risks.

ANIST SP 800-37Correct

NIST Special Publication (SP) 800-37, "Guide for Applying the Risk Management Framework to Federal Information Systems," specifically details the six-step RMF process. This publication replaced the earlier Certification and Accreditation (C&A) framework with an emphasis on continuous risk management and the authorization of information systems based on an acceptable level of residual risk. It provides the foundational guidance for implementing RMF.

BNIST SP 800-39

NIST SP 800-39 focuses on managing information security risk, providing an organization-wide risk management process, but not the detailed RMF application guide.

CNIST SP 800-53

NIST SP 800-53 provides the catalog of security and privacy controls for federal information systems, which are selected and implemented within the RMF process, but it is not the RMF guide itself.

DNIST SP 800-40

NIST SP 800-40, "Guide to Enterprise Patch Management Technologies," is unrelated to the RMF process.

Concept tested: NIST Risk Management Framework (RMF) guidance

Source: https://csrc.nist.gov/publications/detail/sp/800-37/rev-2/final

Topics

#NIST RMF#SP 800-37#Authorization process#Security Life Cycle

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CGRC Practice