What are the six steps of the RMF? Response:

The correct answer is A. Categorize. The Risk Management Framework (RMF) is a structured approach to managing information security risk, and its initial step is to categorize the information system.

Security and Privacy Governance, Risk Management, and Compliance Program

Question

Options

ACategorize
BCategorize
CMonitor
DAssess

How the community answered

(20 responses)

A
90% (18)
C
5% (1)
D
5% (1)

Why each option

The Risk Management Framework (RMF) is a structured approach to managing information security risk, and its initial step is to categorize the information system.

ACategorizeCorrect

Categorize is the first step in the RMF, where organizations define the security category of information systems based on the potential impact of a loss of confidentiality, integrity, or availability. This initial step sets the foundation for subsequent risk management activities.

BCategorize

While 'Categorize' is a step, it is a redundant option when 'A' already represents 'Categorize' and the question asks for a step in the RMF.

CMonitor

Monitor is a step in the RMF, but it is the final ongoing step, focusing on continuous oversight, rather than the initial foundational step.

DAssess

Assess is a step in the RMF, occurring after selecting and implementing controls, but it is not the initial step in the framework.

Concept tested: NIST Risk Management Framework (RMF) steps

Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf

Topics

#RMF#NIST RMF#Categorize#Risk Management Framework Steps

Community Discussion

No community discussion yet for this question.

Full CGRC Practice