CGRC · Question #177
Step 7 of the risk management framework can be described as: Response:
The correct answer is C. The post-authorization phase of the system authorization plan. Step 7 of the NIST Risk Management Framework (RMF) is 'Monitor,' which directly corresponds to the post-authorization phase of a system authorization plan, involving continuous security oversight.
Question
Step 7 of the risk management framework can be described as:
Response:
Options
- AThe certification phase of the system authorization plan
- BThe authorization phase of the system authorization plan
- CThe post-authorization phase of the system authorization plan
- DThe pre-certification phase of the system authorization plan
How the community answered
(54 responses)- A2% (1)
- B4% (2)
- C85% (46)
- D9% (5)
Why each option
Step 7 of the NIST Risk Management Framework (RMF) is 'Monitor,' which directly corresponds to the post-authorization phase of a system authorization plan, involving continuous security oversight.
The certification phase aligns with Step 5 ('Assess') of the RMF, which involves evaluating security controls, not Step 7.
The authorization phase aligns with Step 6 ('Authorize') of the RMF, where a senior official makes a risk-based decision to authorize system operation, not Step 7.
The NIST Risk Management Framework's Step 7 is 'Monitor,' which entails continuous monitoring of security controls, ongoing risk assessments, and reporting on the security posture of an information system. This aligns precisely with the post-authorization phase, where ongoing vigilance and adaptation are crucial after the initial authorization decision.
The pre-certification phase aligns with earlier RMF steps such as Prepare, Categorize, Select, and Implement (Steps 1-4), which precede the formal assessment and authorization process.
Concept tested: NIST RMF Step 7 - Monitor
Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf
Topics
Community Discussion
No community discussion yet for this question.