CAS-004 Governance, Risk, and Compliance Practice Question
A company is considering adopting the NIST Risk Management Framework (RMF). Which of the following steps is unique to NIST RMF compared to ISO 27005?
⚠ Common exam trap
CAS-005 often tests framework-specific terminology, and candidates may incorrectly assume that risk assessment or treatment is unique to NIST RMF when these are shared with ISO 27005; the unique step is system categorization via FIPS 199.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
System categorization
System categorization is a step unique to the NIST RMF (Step 1: Categorize) that uses FIPS 199 to classify information systems by impact level (Low, Moderate, High). ISO 27005 focuses on risk management processes — risk identification, assessment, and treatment — but does not include a formal system categorization step as part of its framework. This makes system categorization the correct differentiator.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
System categorization
Why this is correct
System categorisation, assigning impact levels (low, moderate, high) based on confidentiality, integrity and availability, is a distinctive early step in the NIST RMF. ISO 27005 addresses risk assessment and treatment without mandating this formal categorisation phase, making it the unique element.
- ✗
Risk identification
Why it's wrong here
Risk identification appears in ISO 27005 too, so it cannot distinguish the frameworks. NIST RMF's unique step is categorisation, which assigns impact levels before control selection. Risk identification is genuinely useful when scoping an assessment or building a risk register, but it is a shared activity, not a differentiator between these two standards.
- ✗
Risk treatment
Why it's wrong here
Risk treatment appears in both frameworks, so it cannot be the step unique to NIST RMF. ISO 27005 structures risk treatment as selecting controls against its risk criteria, making it a shared activity rather than a distinguishing one. It is tempting because treatment planning is central to risk management, and it would be the right answer if the question asked which step both frameworks share.
- ✗
Risk assessment
Why it's wrong here
Risk assessment is central to ISO 27005, which details risk identification, analysis and evaluation, so it is not unique to the NIST RMF. The RMF's distinctive addition is the categorise step, absent from ISO 27005.
Go deeper
Related to this question
About these practice questions
One of 973 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.