CGRC · Question #568
What is RMF Step 2? Response:
The correct answer is A. Select Controls. In the NIST Risk Management Framework (RMF) Revision 1, Step 2 is to Select Controls, which involves choosing the appropriate security controls for the information system.
Question
What is RMF Step 2? Response:
Options
- ASelect Controls
- BAuthorize
- CCategorization
- DSystem Boundary
How the community answered
(33 responses)- A91% (30)
- B3% (1)
- D6% (2)
Why each option
In the NIST Risk Management Framework (RMF) Revision 1, Step 2 is to Select Controls, which involves choosing the appropriate security controls for the information system.
According to NIST Special Publication 800-37 Revision 1, the Risk Management Framework comprises six steps. Step 2 in this revision is 'Select Security Controls,' where organizations identify and choose an initial set of baseline security controls from NIST SP 800-53 based on the system's security categorization.
Authorize is Step 5 in NIST RMF Revision 1, where a senior official makes a risk-based decision to authorize system operation.
Categorization (or 'Categorize Information System') is Step 1 in NIST RMF Revision 1, where the information system is defined and its impact level is determined.
System Boundary definition is a preparatory activity that occurs within Step 1 (Categorize) of the RMF, not a distinct step itself.
Concept tested: NIST RMF Revision 1 steps
Source: https://csrc.nist.gov/publications/detail/sp/800-37/rev-1/final
Topics
Community Discussion
No community discussion yet for this question.