CGRC · Question #333
What RMF role is primarily responsible for Tasks 1, 2, and 3 in Assessing Security Controls? Response:
The correct answer is A. Security Control Assessor. The Security Control Assessor (SCA) is the RMF role primarily tasked with executing the first three tasks in the Assessing Security Controls step: developing, approving, and executing the security assessment plan.
Question
What RMF role is primarily responsible for Tasks 1, 2, and 3 in Assessing Security Controls? Response:
Options
- ASecurity Control Assessor
- BSecurity Assessment Report
- CSecurity Control Assessment
- DAssess Security Controls
How the community answered
(51 responses)- A90% (46)
- B6% (3)
- C2% (1)
- D2% (1)
Why each option
The Security Control Assessor (SCA) is the RMF role primarily tasked with executing the first three tasks in the Assessing Security Controls step: developing, approving, and executing the security assessment plan.
The Security Control Assessor (SCA) is the designated RMF role responsible for independently assessing the security controls implemented for an information system. This includes developing the security assessment plan (Task 1), approving the plan (Task 2, though often done in conjunction with others like the Authorizing Official), and executing the plan (Task 3), thereby verifying control effectiveness.
A Security Assessment Report (SAR) is an output document summarizing the findings of the assessment, not a role.
"Security Control Assessment" refers to the overall process or activity of evaluating controls, not a specific role within the RMF.
"Assess Security Controls" is a phase or step within the RMF, not an individual role responsible for performing the tasks.
Concept tested: RMF roles and responsibilities (Security Control Assessor)
Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf
Topics
Community Discussion
No community discussion yet for this question.