CGRC · Question #364
Which of the following are "not" a phase of the NIST Risk Management Framework? Response:
The correct answer is A. Review. This question asks to identify which option is not one of the official phases of the NIST Risk Management Framework (RMF).
Question
Which of the following are "not" a phase of the NIST Risk Management Framework? Response:
Options
- AReview
- BImplement
- CMonitor
- DAuthorize
How the community answered
(46 responses)- A93% (43)
- C2% (1)
- D4% (2)
Why each option
This question asks to identify which option is not one of the official phases of the NIST Risk Management Framework (RMF).
The NIST Risk Management Framework (RMF) phases are Categorize, Select, Implement, Assess, Authorize, and Monitor. "Review" is not a distinct, named phase of the RMF, although reviews occur throughout the process.
“Implement” is Step 3 of the NIST RMF, where security controls are put into place.
“Monitor” is Step 6 of the NIST RMF, involving continuous monitoring of security controls.
“Authorize” is Step 5 of the NIST RMF, where the authorizing official makes a risk-based decision to authorize system operation.
Concept tested: NIST Risk Management Framework phases
Source: https://csrc.nist.gov/projects/risk-management/about-rmf
Topics
Community Discussion
No community discussion yet for this question.