BOE & Artifacts
Body of Evidence
What does RMF stand for?
Risk Management Framework
What does NIST stand for?
National Institute of Standards and Technology
What does ATO stand for?
Authorization to Operate
Your System Owner asks for a copy of the SSP. What document do you provide?
The current System Security Plan (SSP).
What document describes a system's security controls and how they are implemented?
System Security Plan (SSP)
How many total steps are in the NIST RMF, including Step 0?
Seven
Which NIST control family focuses on managing user access and permissions?
AC — Access Control
Who has the authority to accept the risk associated with operating an information system?
The Authorizing Official (AO)
Your TPOC says a control is implemented but cannot provide supporting evidence. What should you do?
Request appropriate BOE, coordinate with the TPOC, and document the evidence gap until it can be verified.
What document tracks identified security weaknesses, corrective actions, milestones, and remediation deadlines?
Plan of Action and Milestones (POA&M)
During which RMF step are security controls selected based on the system's security categorization?
Step 2 — Select
Which NIST control addresses vulnerability monitoring and scanning?
RA-05
What is the primary purpose of an ATO briefing?
To present the system's security posture, assessment results, risks, and authorization recommendation to support the AO's decision.
A vulnerability scan identifies a High vulnerability. What should you do as the ISSO?
Coordinate with the technical team to assess the risk, identify remediation actions, track progress, and document the finding as required.
What document identifies critical business functions and evaluates the impact of a system disruption?
Business Impact Analysis (BIA)
During which RMF step are security controls evaluated to determine whether they are implemented correctly and operating as intended?
Step 4 — Assess
Which NIST control family addresses audit logging, audit record review, and accountability?
AU — Audit and Accountability
Can a system receive an ATO if it has open POA&Ms?
Yes, if the AO determines the remaining risk is acceptable and applicable authorization requirements are met.
Your System Owner wants to introduce a major change to the system. What assessment should be performed to evaluate its security impact?
A Security Impact Analysis (SIA).
What document summarizes the results of a security control assessment, including identified weaknesses and recommendations?
Security Assessment Report (SAR)
Which RMF step involves the Authorizing Official reviewing the authorization package and making a risk-based authorization decision?
Step 5 — Authorize
What is the difference between RA-05 and SI-02?
RA-05 focuses on identifying and monitoring vulnerabilities; SI-02 focuses on identifying, reporting, and remediating system flaws.
What is the difference between an ATO and an ATT?
An ATO (Authorization to Operate) authorizes operation of a system; an ATT (Authorization to Test) permits specified testing activities under defined conditions and limitations.
During an assessment, a control is determined to be Other Than Satisfied. What steps should the ISSO take?
Document the deficiency, coordinate with stakeholders to determine corrective actions, establish a POA&M when required, track remediation, and obtain evidence to validate resolution.