nerdexam
(ISC)2

CGRC · Question #310

As indicated in NIST SP 800-37, and NIST SP 800-53 the RMF provides inputs to the risk management strategy, including: laws, directives, and policy guidance; strategic goals and objectives…

The correct answer is D. Priorities and resources availability. The RMF incorporates various organizational inputs into its risk management strategy, including priorities and resource availability, alongside laws, directives, and security requirements.

Security and Privacy Governance, Risk Management, and Compliance Program

Question

As indicated in NIST SP 800-37, and NIST SP 800-53 the RMF provides inputs to the risk management strategy, including: laws, directives, and policy guidance; strategic goals and objectives; information security requirements; and:

Response:

Options

  • ASegment and solution architecture
  • BFEA reference models
  • CMission/business processes
  • DPriorities and resources availability

How the community answered

(31 responses)
  • B
    3% (1)
  • C
    3% (1)
  • D
    94% (29)

Why each option

The RMF incorporates various organizational inputs into its risk management strategy, including priorities and resource availability, alongside laws, directives, and security requirements.

ASegment and solution architecture

Segment and solution architecture are elements of system design and implementation, not primary inputs to the overall risk management strategy.

BFEA reference models

FEA (Federal Enterprise Architecture) reference models are architectural frameworks, not direct inputs to the risk management strategy concerning practical implementation considerations.

CMission/business processes

Mission/business processes are supported by systems, but the *priorities* and *resources* dedicated to these processes are the direct strategic inputs.

DPriorities and resources availabilityCorrect

NIST SP 800-37 Revision 2 explicitly identifies 'priorities and resources availability' as crucial organizational inputs that inform the enterprise risk management strategy. These inputs ensure that the strategy is realistic, aligned with organizational goals, and feasible given existing constraints and strategic importance.

Concept tested: RMF Inputs to Risk Management Strategy

Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf

Topics

#NIST RMF inputs#Risk Management Strategy#NIST SP 800-37#Priorities and Resources

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CGRC Practice