nerdexam
(ISC)2

CGRC · Question #536

One of the ensuing in not an activity conducted when preparing to implement the risk management framework. Response:

The correct answer is A. Security test and evaluation (ST&E). When preparing to implement the Risk Management Framework (RMF), foundational activities focus on setting up the organizational context and strategy, rather than specific technical testing. Security Test and Evaluation (ST&E) is an activity that occurs later in the RMF process, d

Security and Privacy Governance, Risk Management, and Compliance Program

Question

One of the ensuing in not an activity conducted when preparing to implement the risk management framework. Response:

Options

  • ASecurity test and evaluation (ST&E)
  • BIdentifying key stakeholders (internal and external to the organization) that have an interest in the
  • CEstablishing a risk management strategy and organizational risk tolerance.
  • DAssigning roles and responsibilities for organizational risk management processes.

How the community answered

(31 responses)
  • A
    94% (29)
  • B
    3% (1)
  • C
    3% (1)

Why each option

When preparing to implement the Risk Management Framework (RMF), foundational activities focus on setting up the organizational context and strategy, rather than specific technical testing. Security Test and Evaluation (ST&E) is an activity that occurs later in the RMF process, during the implementation and assessment of security controls.

ASecurity test and evaluation (ST&E)Correct

Security test and evaluation (ST&E) is an activity performed during the RMF's Implement and Assess steps, which occur after the initial preparation phase for establishing the risk management context.

BIdentifying key stakeholders (internal and external to the organization) that have an interest in the

Identifying key stakeholders is a crucial preparation activity to ensure all relevant parties are engaged in the RMF process.

CEstablishing a risk management strategy and organizational risk tolerance.

Establishing a risk management strategy and organizational risk tolerance is a foundational preparation activity that guides all subsequent RMF steps.

DAssigning roles and responsibilities for organizational risk management processes.

Assigning roles and responsibilities for risk management is essential in the preparation phase to define accountability and ensure proper execution of the RMF.

Concept tested: RMF Prepare step activities

Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf

Topics

#Risk Management Framework (RMF)#RMF Prepare Step#Security Test and Evaluation (ST&E)#Risk Management Program

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CGRC Practice