28 questions · System Compliance topic · All types, answers revealed
When a system is undergoing a major change, what is the impact on the existing ATO?
Major changes trigger a re-authorization process.
Why this answer
A major change invalidates the existing ATO because the security posture has fundamentally changed, requiring a re-assessment.
What is the purpose of the Security Assessment Report (SAR)?
It summarizes the assessment findings.
Why this answer
The SAR documents the results of the control assessment, including findings and recommendations.
You are auditing an organization's POA&M process. Which of the following indicates an ineffective process?
This prevents tracking and accountability.
Why this answer
POA&Ms must include completion dates. Without them, there is no accountability for remediation.
Which role is responsible for the ongoing monitoring of security controls after an ATO is granted?
The ISSO performs the continuous monitoring tasks.
Why this answer
The ISSO is responsible for the day-to-day management and monitoring of the security controls.
Which phase of the RMF includes the 'continuous monitoring' of security controls?
This is where continuous monitoring occurs.
Why this answer
The 'Monitor' step is the final phase of the RMF, focused on ongoing compliance.
Which THREE elements are necessary for a compliant continuous monitoring program?
Ensures changes are tracked.
Why this answer
Continuous monitoring requires regular assessment, tracking of changes, and reporting of the security posture.
An Authorizing Official grants an 'ATO with Conditions.' What does this mean for the system owner?
Conditions require timely remediation of identified risks.
Why this answer
An ATO with conditions means the system can operate, but specific security gaps must be closed within a defined timeframe to maintain authorization.
You are utilizing the NIST SP 800-37 R2 process for an Authorization to Operate (ATO). At what point is the Security Assessment Report (SAR) presented to the Authorizing Official?
The SAR is a required input for the authorization decision.
Why this answer
The SAR provides the technical basis for the AO to make the risk-based decision after the assessment is complete.
Which TWO factors should an ISSO consider when determining if a system change requires a re-authorization?
If controls are weakened, it requires re-evaluation.
Why this answer
The magnitude of the change and the impact on the security controls are the two key triggers for re-authorization.
Which TWO actions should an ISSO take when a critical security control is found to be ineffective during assessment?
Findings must be reported.
Why this answer
The ISSO must document the finding in the SAR and work with the system owner to document the mitigation in a POA&M.
A contractor provides a service for your organization. How do you ensure the contractor's system is compliant?
Contractual requirements are the primary mechanism for third-party compliance.
Why this answer
Incorporating security requirements into the contract (like FAR/DFARS clauses) ensures the contractor is legally bound to meet security standards.
An Authorizing Official (AO) is reviewing a Plan of Action and Milestones (POA&M) for a high-impact system. What is the AO's primary responsibility regarding this document?
The AO signs off on the risk acceptance.
Why this answer
The AO is accountable for the risk the system poses to the organization and must approve the mitigation strategy outlined in the POA&M.
If a security control is deemed 'Not Applicable' (NA) in the System Security Plan (SSP), what must the system owner provide?
Justification is required to ensure the control was not mistakenly omitted.
Why this answer
For a control to be N/A, there must be a valid justification based on the system's architecture or operational environment.
When assessing a cloud service provider (CSP) using a FedRAMP-authorized solution, what is the primary benefit to your organization?
The 'do once, use many' principle applies here.
Why this answer
Using a pre-authorized CSP means the government has already assessed the security controls, reducing the need for redundant assessments.
Which THREE of the following are valid components of an Authorization Package?
Core component.
Why this answer
The Authorization Package consists of the SSP, SAR, and POA&M as the core elements for the AO.
Which THREE categories of controls are identified in NIST SP 800-53?
A valid control category.
Why this answer
NIST categorizes controls into Technical, Management, and Operational families.
Which TWO of the following are responsibilities of the Authorizing Official?
AO responsibility.
Why this answer
The AO is the final risk decision maker and is accountable for the system's security status.
Which document provides the formal authority to operate a system?
This document conveys the AO's decision.
Why this answer
The Authorization Decision Document (ADD) or ATO letter is the formal record of the AO's decision.
Which TWO documents are essential for an Authorizing Official to make an informed risk-based decision?
Essential for knowing the remediation plan for weaknesses.
Why this answer
The SAR provides the technical assessment, and the POA&M identifies how identified weaknesses will be addressed.
What is the relationship between the System Security Plan (SSP) and the Security Assessment Report (SAR)?
The SAR is the validation of the SSP.
Why this answer
The SSP describes the controls that *should* be in place, and the SAR reports on whether those controls are actually effective.
Which THREE types of information should be included in a risk acceptance memo?
Must define what is being accepted.
Why this answer
Risk acceptance must document the specific risk, the impact, and the duration or justification for accepting it.
An information system security officer (ISSO) is preparing the Security Assessment Plan (SAP) in the NIST Risk Management Framework. Which component must be identified first to ensure the assessment coverage is adequate?
Establishing the boundary is the first step in assessing compliance.
Why this answer
Identifying the scope and boundaries of the system is the prerequisite for developing a SAP to ensure all components under the authorization boundary are evaluated.
A system is found to have a critical vulnerability that cannot be patched. You are documenting a risk acceptance request. What is the most critical piece of information to include for the AO?
AO decisions are based on the balance of mission need vs. residual risk.
Why this answer
The AO needs to understand the impact of the risk on the organizational mission to make an informed decision.
When determining compliance for a cloud-based service, which document serves as the primary evidence of the provider's security controls?
This contains the security control documentation for the service.
Why this answer
A FedRAMP Authorization Package or a third-party audit report (like SOC 2) is the standard evidence for cloud compliance.
You are performing a compliance determination on a system that shares data with an external partner. What is the most important factor in the authorization boundary determination?
Boundary is defined by what the system owner has the authority to protect.
Why this answer
The authorization boundary defines the scope of the system and everything subject to the security controls, including interconnected systems.
During the compliance determination phase, you discover that a legacy application lacks multi-factor authentication (MFA) but is isolated within a physically secured enclave. Which action should you take to document this in the Security Assessment Report (SAR)?
Compensating controls are valid methods to meet security requirements.
Why this answer
Documenting compensating controls allows the assessor to show how the security objective is met despite the missing control.
While reviewing a system's compliance, you notice the Security Control Assessor (SCA) used an interview method for a technical control that requires automated testing. How should you address this in your review?
Technical controls require testing (functional verification) rather than just interviews.
Why this answer
Security assessments must follow NIST SP 800-53A guidance, which specifies appropriate assessment methods (examine, interview, test) for each control.
What is the primary role of the Security Control Assessor (SCA)?
The SCA validates the controls.
Why this answer
The SCA provides an objective, third-party assessment of the security controls to support the authorization decision.
Ready to test yourself?
Try a timed practice session using only System Compliance questions.