CGRC · Question #713
The RMF Step and task where the System Security Plan is initially approved by the AO or AODR. Response:
The correct answer is A. RMF Step 2, Task 4. The System Security Plan is initially approved by the Authorizing Official or their Designated Representative during RMF Step 2, Task 4.
Question
The RMF Step and task where the System Security Plan is initially approved by the AO or AODR. Response:
Options
- ARMF Step 2, Task 4
- BRMF Step 2, Task 2
- CRMF Step 2, Task 3
- DRMF Step 2, Task 1
How the community answered
(26 responses)- A92% (24)
- B4% (1)
- C4% (1)
Why each option
The System Security Plan is initially approved by the Authorizing Official or their Designated Representative during RMF Step 2, Task 4.
In the NIST Risk Management Framework, the System Security Plan (SSP) is developed during Step 2 (Categorize System) and is formally approved by the Authorizing Official (AO) or their Designated Representative (AODR) as part of Task 2-4, which focuses on documenting the security plan. This approval signifies that the plan is suitable for implementation.
RMF Step 2, Task 2 involves security control selection, not SSP approval.
RMF Step 2, Task 3 focuses on supplemental control specification and tailoring, not SSP approval.
RMF Step 2, Task 1 involves categorizing the information system, not SSP approval.
Concept tested: RMF steps and tasks (SSP approval)
Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf
Topics
Community Discussion
No community discussion yet for this question.