CCNA System Compliance Questions

The control is only partially implemented because effective audit logging requires both generation and review. The SAR should document the gap, explain how the missing review reduces the control's ability to detect incidents, and recommend remediation. This accurate finding supports risk-based decisions and ensures the Authorizing Official understands the true security posture.

A major change alters the system's security posture, invalidating the original authorisation boundary. The authorising official must re-evaluate the ATO, reassessing controls and residual risk, because the existing approval no longer reflects the modified environment.

The SSP is the primary document that describes the system's security requirements, controls, and their implementation. It provides a comprehensive overview of how the system meets its security requirements. The AO uses the SSP to understand the system's security posture and make an authorization decision. It is a key artifact in the RMF process.

The Security Assessment Report documents the assessor's findings on whether implemented controls are effective, giving authorising officials an evidence-based snapshot at a point in time. It supports the authorisation decision by recording control implementation effectiveness rather than prescribing remediation or defining requirements.

Compliance determination requires verifying that the control is implemented according to the security plan and that it operates as intended. This includes examining the implementation, testing its functionality, and confirming it meets the stated requirements. Without evidence of correct implementation and effectiveness, the control cannot be deemed compliant, even if documentation exists.

Completion dates are mandatory in a POA&M; without them, milestones cannot be tracked, remediation cannot be scheduled, and progress cannot be measured. Listing weaknesses with no target dates therefore demonstrates an ineffective process, since the plan cannot drive or evidence closure.

When a control is only partially implemented, the SSP must accurately reflect that status, including the specific gap, planned remediation actions, and a target date. This transparency supports risk-based decision-making by the Authorizing Official. Documenting the partial implementation also allows continuous monitoring to track progress and ensures the assessment report aligns with the SSP, maintaining the integrity of the authorization package.

The POA&M is the primary tool for documenting known weaknesses that require remediation, along with the planned actions, resources, and milestones. It enables the ISSO and system owner to track progress and provides the Authorizing Official with visibility into residual risk. This supports continuous monitoring and informed authorization decisions.

The Monitor phase of the RMF is where continuous monitoring activities occur, assessing control effectiveness and tracking changes on an ongoing basis. This satisfies the stem's requirement by placing ongoing control monitoring within the correct RMF phase.

Configuration management maintains an accurate inventory of system components and their baselines, which continuous monitoring depends on to track changes. Without it, assessments and status reporting would reference stale or unknown system states, so it satisfies the stem's necessary element for compliance.

An ATO with Conditions authorises operation only while the system owner remediates specified weaknesses within agreed timeframes. The authorisation remains valid contingent on meeting those security requirements; failure to satisfy them can trigger revocation or suspension of the authority to operate.

Examination involves reviewing configurations, documentation, and system settings, while testing involves exercising the control to observe its behavior. Together, they provide direct, objective evidence that encryption is implemented correctly and operates as intended. For a technical control, this combination is the most reliable because it validates both design and operational effectiveness, reducing the risk of false assurance from interviews alone.

Under NIST SP 800-37 R2, the Assess step produces the Security Assessment Report, which the security assessor delivers to the Authorizing Official as evidence supporting the Authorize decision. The SAR therefore precedes authorisation, not the reverse.

Re-authorisation hinges on whether the change alters the security control baseline enough to invalidate the original authorisation decision. If controls are added, removed or weakened, the residual risk profile shifts, so the ISSO must reassess whether the existing authority to operate still holds.

Configuration management and change control are essential for continuous monitoring because they ensure that system changes are authorized, documented, and assessed for security impact. Without them, the security posture can degrade unnoticed. NIST SP 800-137 identifies configuration management as a key component of continuous monitoring, enabling organizations to maintain an accurate inventory and baseline.

The Security Assessment Report is the formal record of assessment results, so an ineffective critical control must be captured there to trigger remediation and authorisation decisions. Documenting the finding satisfies the stem's requirement to record the deficiency as evidence for the AO.

Contractual security requirements make compliance auditable and enforceable, letting the organisation specify controls, breach notification and right-to-audit clauses the contractor must meet. This establishes the binding obligation that governs the contractor's system, which informal assurances or trust alone cannot provide.

The Authorizing Official holds risk acceptance authority, so their primary duty on a POA&M for a high-impact system is formally accepting the residual risk documented in it. That satisfies the stem's focus on the AO's decision role rather than remediation or milestone tracking.

Marking a control Not Applicable removes it from the assessment baseline, so the system owner must document a technical justification explaining why the control does not apply to the system's environment, satisfying the SSP's requirement for defensible scoping decisions.

Continuous monitoring is the primary compliance activity during operations and maintenance. It involves ongoing assessment of controls, tracking of changes, and reporting to the Authorizing Official. This ensures that the system remains within its authorized risk tolerance and that any degradation in controls is addressed promptly. It is a requirement of the RMF and supports the ongoing validity of the ATO.

The Authorization Decision Document is the formal record where the AO grants the ATO and explicitly accepts the residual risk. It includes the authorization decision, any terms and conditions, and the expiration date. This document is the official artifact that signifies the AO's risk acceptance.

Ongoing assessment of security control effectiveness is a fundamental part of continuous monitoring. It involves automated and manual evaluations to determine if controls are implemented correctly and operating as intended. This activity provides the data needed to maintain situational awareness and supports risk-based decisions throughout the system lifecycle.

A FedRAMP authorisation means an accredited assessor has already evaluated the CSP against NIST controls and issued a package. Your organisation can reuse that body of evidence, reducing the assessment effort needed for its own authorisation rather than starting from scratch.

The Security Assessment Report documents the assessor's findings against the security controls, including weaknesses and residual risk. It forms part of the Authorization Package alongside the SSP and POA&M, giving the authorising official the evidence needed to make a risk-based authorization decision.

Operational controls are one of the three NIST SP 800-53 control categories, covering day-to-day processes and people-driven activities that keep security running, such as awareness training, contingency planning and incident response. This satisfies the stem's requirement to name the categories alongside management and technical.

The AO must review the POA&M, which documents how the organization will remediate or mitigate the identified weaknesses. This allows the AO to understand residual risk and make an informed authorization decision. The POA&M is a critical input to the authorization package, along with the SAR and System Security Plan (SSP), and must be considered before granting an authorization.

The ISSO's role is to provide the AO with a thorough risk analysis. Before recommending authorization or denial, the ISSO should assess if compensating controls exist that effectively mitigate the risk. Presenting options, such as authorizing with conditions or requiring immediate remediation, allows the AO to make an informed risk-based decision. This approach balances security needs with mission requirements.

The Authorizing Official formally accepts the residual risk and signs the authorisation decision, granting the system authority to operate. This is the AO's defining accountability, distinct from assessors who test controls or system owners who implement them.

The Authorization Decision Document records the authorising official's formal approval for a system to operate, conveying accepted risk and defining terms. It is the artefact that grants authority to operate, distinct from the security plan or assessment report.

When the system owner disputes an assessor's finding, the ISSO should first work with the SCA to resolve the discrepancy by presenting additional evidence. This may lead to a reassessment and potentially overturn the finding, ensuring the assessment report is accurate before it goes to the AO.

The SSP documents the implemented controls and their descriptions, while the SAR records the assessor's findings on whether those controls operate effectively. The SAR therefore evaluates the effectiveness of the controls described in the SSP, establishing the assessment-to-plan relationship the question asks about.

The immediate priority is to eliminate the unauthorized exposure. Removing or restricting the rule aligns the actual configuration with the approved security posture. Afterwards, the SSP must be updated to reflect reality, and a POA&M entry should capture the root cause and corrective actions. This approach restores compliance and addresses the deviation through proper documentation and follow-up.

The memo must identify precisely what risk is being accepted, including its source, affected assets and likelihood. Without a clear description, the acceptance is meaningless, so this satisfies the requirement to document the specific identified risk being formally tolerated.

The CRM explicitly lists each security control and indicates whether the CSP, the agency, or both are responsible for implementing it. This allows the agency to focus its assessment on the controls it owns and inherit the CSP's assessment for the rest. The CRM is essential for scoping the agency's assessment effort.

The ISSO should first document the finding and work with the CSP to verify compliance or find a compliant alternative. Even if the module is CSP-managed, the system owner remains accountable for ensuring all controls meet requirements. The POA&M tracks remediation, and collaboration with the CSP is necessary to resolve the issue without duplicating effort.

The system and authorisation boundary must be defined first because it determines which components, interfaces and data flows fall within assessment scope. Without it, the SAP cannot ensure adequate coverage of the controls inherited and implemented.

A formal risk acceptance memo or letter is the appropriate document for a system owner to accept a risk. It typically includes the specific risk, its impact, the rationale for acceptance, and the period of acceptance. The system owner's signature on this document provides the necessary authorization to operate with the known risk. This document is then retained as part of the system's authorization package.

Ongoing security control assessments are a fundamental part of continuous monitoring. They involve evaluating controls at a frequency defined by the organization to ensure they remain effective over time. This includes automated and manual assessments. The results feed into the risk determination and help maintain an up-to-date understanding of the system's security posture, enabling timely remediation of deficiencies.

When a control is partially implemented, it is considered a finding. The SAR documents assessment results, and the POA&M tracks remediation activities. This aligns with RMF Step 6 (Monitor) and the requirement to maintain ongoing authorization. The ISSO must ensure the finding is recorded and a plan exists to address the deficiency, which may include milestones and resources.

FedRAMP allows organizations to inherit controls from an authorized CSP, reducing the scope of their own assessment. The organization must still assess controls that are not covered by the CSP's authorization, such as those specific to the system or implemented by the organization. This approach leverages the CSP's authorization while ensuring full coverage.

The authorising official must judge whether residual risk is tolerable, which depends on the potential impact on the organisation's mission. Without that, the acceptance decision lacks the business context needed to weigh the unpatched vulnerability.

The SSP documents the provider's implemented controls, and the Authorization Package contains the assessor's evidence and authorisation decision. Together they provide the primary artefact demonstrating which security controls exist and have been independently evaluated for the cloud service.

Leveraging a CSP's FedRAMP authorization allows the organization to inherit the controls that the CSP implements and documents. These inherited controls are recorded in the SSP, reducing the assessment burden. The organization remains responsible for controls outside the CSP's boundary and for ensuring the CSP's authorization covers the required impact level. This approach is efficient and promotes reciprocity.

The authorization boundary is drawn around components the organisation owns and controls, since shared external partner systems fall outside its direct authority. Ownership and control therefore determine what the boundary legitimately encompasses when data is shared externally.

Monitoring security alerts and advisories is essential to identify new threats and vulnerabilities that may affect the system. NIST SP 800-137 includes this as part of the 'monitor' step. By staying informed, the ISSO can proactively address emerging risks and adjust controls, ensuring the system remains compliant with its security requirements.

The correct action is to treat the non-compliant encryption as a finding. The system owner must develop a POA&M to remediate it by implementing FIPS 140-2 validated cryptography. This aligns with the RMF process of documenting findings and planning remediation. Until remediation, the risk must be assessed and potentially accepted by the AO.

Documenting procedures, evidence, and findings in a SAR provides a transparent record that supports repeatability and auditability. The SAR allows others to understand how conclusions were reached and provides a basis for remediation and continuous monitoring. It also serves as evidence for the Authorizing Official and supports reciprocity across the organization.

Documenting the physically secured enclave as a compensating control directly addresses the MFA deficiency, since the SAR must record how residual risk is mitigated when a required control is absent. Assessing its effectiveness confirms the enclave genuinely constrains access, satisfying the compliance determination requirement to justify accepting the legacy application's deviation.

Automated technical controls must be verified through testing, not interviews, which only capture assertions. Requesting reassessment using the Test method obtains objective evidence that the control operates as specified, satisfying the assessment procedure's required method.

The POA&M is the central document for tracking known security weaknesses that require remediation over time. It records the weakness, planned corrective actions, milestones, and responsible parties. This provides the AO with ongoing visibility into the risk posture and ensures that unresolved findings are managed rather than forgotten. Immediate fixes do not need POA&M entries once verified.

The Security Control Assessor evaluates implemented controls against defined criteria, testing whether they operate as intended and documenting residual risk. This assessment produces the evidence authorising officials use to decide whether a system may be granted an authority to operate.