CGRC · Question #338
In which of the following Risk Management Framework (RMF) phases is strategic risk assessment planning performed? Response:
The correct answer is A. Phase 0. Strategic risk assessment planning is performed in Phase 0, or the Prepare step, of the Risk Management Framework (RMF), where foundational activities and context are established before the formal RMF steps.
Question
In which of the following Risk Management Framework (RMF) phases is strategic risk assessment planning performed? Response:
Options
- APhase 0
- BPhase 1
- CPhase 2
- DPhase 3
How the community answered
(38 responses)- A92% (35)
- B5% (2)
- C3% (1)
Why each option
Strategic risk assessment planning is performed in Phase 0, or the Prepare step, of the Risk Management Framework (RMF), where foundational activities and context are established before the formal RMF steps.
In the current version of the NIST RMF (SP 800-37 Revision 2), the "Prepare" step (often referred to conceptually as Phase 0) involves establishing the foundational context for managing security and privacy risks. This includes strategic risk assessment planning activities at the organizational, mission/business process, and system levels, which are critical prerequisites for the subsequent RMF steps.
Phase 1 of the RMF is typically the "Categorize" step, which focuses on information system categorization based on impact, not strategic risk assessment planning.
Phase 2 of the RMF is typically the "Select" step, where security controls are chosen based on the system's categorization.
Phase 3 of the RMF is typically the "Implement" step, where the selected security controls are put into practice.
Concept tested: NIST RMF Prepare phase (Phase 0)
Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf
Topics
Community Discussion
No community discussion yet for this question.