nerdexam
(ISC)2

CGRC · Question #700

Which of the following specifies security requirements for federal information and information systems in 17 security-related areas that represent a broad-based, balanced information security…

The correct answer is B. FIPS 200, Minimum Security Requirements for Federal Information and Information Systems. FIPS 200, titled "Minimum Security Requirements for Federal Information and Information Systems," specifies baseline security requirements across 17 control families for federal systems. This standard is crucial for establishing a balanced information security program.

Security and Privacy Governance, Risk Management, and Compliance Program

Question

Which of the following specifies security requirements for federal information and information systems in 17 security-related areas that represent a broad-based, balanced information security program? Response:

Options

  • AFederal Information Processing Standard (FIPS) 199, Standards for Security Categorization of
  • BFIPS 200, Minimum Security Requirements for Federal Information and Information Systems
  • CCommittee on National Security Systems (CNSS) Instruction No. 1253, Security Categorization
  • DSection 3541 Title 44 U.S.C. Federal Information Security Management Act of 2002

How the community answered

(54 responses)
  • A
    2% (1)
  • B
    91% (49)
  • C
    4% (2)
  • D
    4% (2)

Why each option

FIPS 200, titled "Minimum Security Requirements for Federal Information and Information Systems," specifies baseline security requirements across 17 control families for federal systems. This standard is crucial for establishing a balanced information security program.

AFederal Information Processing Standard (FIPS) 199, Standards for Security Categorization of

FIPS 199 deals with the security categorization of information and information systems (low, moderate, high impact), not the detailed security requirements.

BFIPS 200, Minimum Security Requirements for Federal Information and Information SystemsCorrect

FIPS 200, "Minimum Security Requirements for Federal Information and Information Systems," provides a structured approach to defining minimum security requirements across 17 security-related areas (control families) for federal information and systems. This standard is fundamental in establishing a balanced, risk-based information security program by requiring agencies to meet these baselines through the selection and implementation of appropriate security controls.

CCommittee on National Security Systems (CNSS) Instruction No. 1253, Security Categorization

CNSS Instruction No. 1253 adapts FIPS 199 and FIPS 200 for national security systems, but FIPS 200 is the primary source for the 17 control families for federal systems.

DSection 3541 Title 44 U.S.C. Federal Information Security Management Act of 2002

FISMA (Federal Information Security Management Act) is the law that mandates the security of federal information systems, but FIPS 200 is the standard that specifies the requirements.

Concept tested: FIPS 200 security requirements

Source: https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.200.pdf

Topics

#FIPS 200#Security Requirements#Federal Information Systems#NIST Standards

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CGRC Practice