CGRC · Question #175
System Authorization is the risk management process. System Authorization Plan (SAP) is a comprehensive and uniform approach to the System Authorization Process. What are the different phases of…
The correct answer is A. Post-Authorization B. Pre-certification D. Certification E. Authorization. The phases of a System Authorization Plan typically encompass pre-certification activities, the formal certification assessment, the authorization decision, and continuous monitoring post-authorization.
Question
System Authorization is the risk management process. System Authorization Plan (SAP) is a comprehensive and uniform approach to the System Authorization Process. What are the different phases of System Authorization Plan? Each correct answer represents a part of the solution. Choose all that apply. Response:
Options
- APost-Authorization
- BPre-certification
- CPost-certification
- DCertification
- EAuthorization
How the community answered
(34 responses)- A94% (32)
- C6% (2)
Why each option
The phases of a System Authorization Plan typically encompass pre-certification activities, the formal certification assessment, the authorization decision, and continuous monitoring post-authorization.
Post-Authorization involves continuous monitoring, ongoing assessments, and reauthorization activities to ensure that the system's security posture remains acceptable over time.
Pre-certification includes initial planning, system design, control implementation, and preparation for the formal security assessment.
Post-certification is not typically a distinct phase in the same manner; activities following certification are usually covered under the broader 'Post-Authorization' phase, which includes continuous monitoring and reauthorization cycles.
Certification is the phase where an independent assessment team evaluates the implemented security controls to determine if they meet the specified security requirements.
Authorization is the formal decision by a designated official to permit operation of an information system, based on an acceptable level of risk.
Concept tested: System Authorization Plan phases (NIST RMF)
Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf
Topics
Community Discussion
No community discussion yet for this question.