nerdexam
(ISC)2

CGRC · Question #670

The phase 3 of the Risk Management Framework (RMF) process is known as mitigation planning. Which of the following processes take place in phase 3? Each correct answer represents a complete…

The correct answer is B. Document and implement a mitigation plan. C. Agree on a strategy to mitigate risks. D. Evaluate mitigation progress and plan next assessment. The question identifies Phase 3 of the Risk Management Framework (RMF) as mitigation planning and asks which specific processes occur within this phase.

Security and Privacy Governance, Risk Management, and Compliance Program

Question

The phase 3 of the Risk Management Framework (RMF) process is known as mitigation planning. Which of the following processes take place in phase 3? Each correct answer represents a complete solution. Choose all that apply. Response:

Options

  • AIdentify threats, vulnerabilities, and controls that will be evaluated.
  • BDocument and implement a mitigation plan.
  • CAgree on a strategy to mitigate risks.
  • DEvaluate mitigation progress and plan next assessment.

How the community answered

(39 responses)
  • A
    8% (3)
  • B
    92% (36)

Why each option

The question identifies Phase 3 of the Risk Management Framework (RMF) as mitigation planning and asks which specific processes occur within this phase.

AIdentify threats, vulnerabilities, and controls that will be evaluated.

Identifying threats, vulnerabilities, and controls typically occurs during earlier assessment or categorization phases within an RMF, preceding the dedicated mitigation planning phase.

BDocument and implement a mitigation plan.Correct

Documenting and implementing a mitigation plan are core activities in the mitigation planning phase, translating strategies into actionable steps and putting them into practice.

CAgree on a strategy to mitigate risks.Correct

Agreeing on a strategy to mitigate risks involves selecting appropriate risk responses and developing the high-level approach for addressing identified risks, which is a fundamental part of planning mitigation.

DEvaluate mitigation progress and plan next assessment.Correct

Evaluating mitigation progress and planning the next assessment ensures that the implemented mitigation strategies are effective and informs future monitoring and adjustments, thus being an integral part of ongoing mitigation management.

Concept tested: RMF Mitigation Planning Phase Activities

Topics

#Risk Management Framework (RMF)#Risk Mitigation Planning#Control Implementation#Risk Assessment and Evaluation

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CGRC Practice