CGRC · Question #188
What is the 1st task in Security Controls Assessment; where the assessment plan is developed, reviewed, and approved to assess the controls? Response:
The correct answer is A. Assessment Preparation. The first task in the Security Controls Assessment step of the NIST RMF is Assessment Preparation, where the assessment plan is developed, reviewed, and approved.
Question
What is the 1st task in Security Controls Assessment; where the assessment plan is developed, reviewed, and approved to assess the controls? Response:
Options
- AAssessment Preparation
- BAssessment Plan
- CAssessment Security
- DAssessment Controls
How the community answered
(45 responses)- A93% (42)
- C2% (1)
- D4% (2)
Why each option
The first task in the Security Controls Assessment step of the NIST RMF is Assessment Preparation, where the assessment plan is developed, reviewed, and approved.
According to NIST SP 800-37, the "Assess" step (Step 4) begins with Task 4-1, "Prepare for Assessment." This task specifically involves developing an assessment plan, reviewing it with relevant stakeholders, and obtaining approval before proceeding with the actual control assessments.
“Assessment Plan” is a deliverable or a component of the preparation phase, not the name of the initial task itself within the RMF.
“Assessment Security” is a broad concept related to securing the assessment process, not a specific RMF task name.
“Assessment Controls” refers to the actual process of evaluating the effectiveness of security controls, which happens after the preparation phase.
Concept tested: NIST RMF Step 4 Task 1 - Assessment Preparation
Source: https://csrc.nist.gov/publications/detail/sp/800-37/rev-2/final
Topics
Community Discussion
No community discussion yet for this question.