CGRC · Question #212
The registration of the system directly follows which RMF task? Response:
The correct answer is B. Task P-17 Requirements allocation. In the NIST Risk Management Framework (RMF), the task of system registration directly follows Task P-17, which involves allocating security requirements to system components. This sequence ensures that initial security planning is complete before formal registration.
Question
The registration of the system directly follows which RMF task? Response:
Options
- ACategorize the system
- BTask P-17 Requirements allocation
- CSelect security controls
- DReview and approve the SSP
How the community answered
(23 responses)- A4% (1)
- B87% (20)
- D9% (2)
Why each option
In the NIST Risk Management Framework (RMF), the task of system registration directly follows Task P-17, which involves allocating security requirements to system components. This sequence ensures that initial security planning is complete before formal registration.
Categorize the system is the first step of the RMF, which occurs before detailed planning and requirements allocation.
According to the NIST RMF, particularly the 'Prepare' step in SP 800-37 Rev. 2, Task P-17 'Requirements Allocation' involves assigning security requirements to specific system components, which is a foundational activity that must be completed to define the system's security posture before it can be formally registered and documented.
Select security controls is the second step of the RMF, occurring after categorization and initial planning, and well before system registration.
Review and approve the SSP (System Security Plan) is part of the 'Authorize' step, occurring much later in the RMF process after controls are implemented and assessed.
Concept tested: NIST RMF task sequence
Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf
Topics
Community Discussion
No community discussion yet for this question.