CGRC · Question #231
NIST SP 800-37, Revision 1, was developed by NIST under the authority of Response:
The correct answer is A. FISMA. NIST Special Publication 800-37, Revision 1, which outlines the Risk Management Framework, was developed and published by NIST under the specific authority granted by FISMA.
Question
NIST SP 800-37, Revision 1, was developed by NIST under the authority of Response:
Options
- AFISMA
- BNIST
- CPOAM
- DISSO
How the community answered
(27 responses)- A89% (24)
- C7% (2)
- D4% (1)
Why each option
NIST Special Publication 800-37, Revision 1, which outlines the Risk Management Framework, was developed and published by NIST under the specific authority granted by FISMA.
The Federal Information Security Management Act (FISMA) of 2002 mandated federal agencies to develop, document, and implement an agency-wide information security program, and it delegated the responsibility to NIST for developing information security standards and guidelines for federal information systems. NIST SP 800-37 is a key guideline developed under this authority.
NIST is the National Institute of Standards and Technology, the agency that developed the document, but not the authority under which it was developed.
POAM stands for Plan of Action and Milestones, a document used in risk management, not an authorizing authority.
ISSO stands for Information System Security Officer, a role within an organization, not an authorizing authority for NIST publications.
Concept tested: FISMA's role in NIST publications
Source: https://www.nist.gov/privacy-framework/nist-sp-800-37-rev-2-risk-management-framework-information-systems-and-organizations
Topics
Community Discussion
No community discussion yet for this question.