Risk Management

Question 1

Tiers of Risk Management

Answer 1

Tier 1 - Organization (governance)
*What does your organization do?

Tier 2 - Mission (Business Process)
*How you’re going to accomplish business goals?

Tier 3 - Information System (Environment of Operations)
*System put in place to accomplish the above

Question 2

RMF

Answer 2

NIST standards and guidance documents to provide a process to reveal risks and protect from threats - helps leadership understand the current status of their security programs and security controls protecting the IS

Question 3

RMF Steps

Answer 3

1) Categorize - Categorize the information and information system
2) Select - Select baseline of security controls and tailor, this produces the SSP
3) Implement
4) Assess - once you assess, you get the SAR
5) Authorize - once you authorize, you get POA&M
6) Continuous Monitoring

Question 4

Roles & Responsibilities - Highest Level

Answer 4

CEO - head of agency - overall responsibility to provide information security protections

Question 5

Roles & Responsibilities - 2nd highest

Answer 5

Risk Executive - helps to ensure risk-related considerations from individuals, risks from systems is consistent

Question 6

Roles & Responsibilities - 3rd highest

Answer 6

CIO - appoint the SAISO (Senior Agency IS Officer) - develop & maintain policies procedures, control teqniques, training and overseeing personnel, assisting senior officials, report annually to head of fed agency

Question 7

Roles & responsibilities - 4th highest

Answer 7

CISO or SISO (Chief or Senior information security officer) - head of organization’s security program office and serves as liaison to SOs, AOs, and ISSOs

Question 8

Roles & responsibilities - 5th highest

Answer 8

AO - makes final decision on ATO - risk is deemed acceptable

Question 9

Roles & responsibilities - 6th highest

Answer 9

AODR - Authorizing Official Designated Representative - acting for AO, can assist but cannot issue ATO

Question 10

Roles & Responsibilities - 7th highest

Answer 10

Information owner - create policies and procedures, they understand, manage their information, provides input to SO regarding requirements and controls for how info is processed, stored, or transmitted

SO - responsible for overall procurement, development, integration, modification, operation, maintenance, disposal of an information system

Question 11

Roles & Responsibilities - 8th highest

Answer 11

ISSO - help ensure security posture is maintained - advisor on all matters involving the security of the information system

Question 12

Roles & Responsibilities - 9th highest

Answer 12

security architect - as changes occur, they asses the risks & implement new controls as needed to safeguard

i.e. Expansions in network connectivity, changes to existing infrastructure & policies, intro to new technologies

Question 13

Roles & Responsibilities - 10th highest

Answer 13

Security Engineers - conduct security engineering activities, captures and refines requirements and ensures requirements are integrated through architecting, design, development, & configuration

Question 14

Roles & Responsibilities - 11th highest

Answer 14

SCA - Security Control Assessor - assess controls - recommend corrective actions - prepares the SAR

Question 15

Roles & Responsibilities - 12th highest

Answer 15

Common Control Providers - responsible for overseeing inherited controls

Question 16

Roles & Responsibilities - 13th highest

Answer 16

Security Practitioners - after engineers implement requirements, practitioners use the IS to ensure accurate implementation

i.e. DB admins, Computer specialists, security analysts, security consultants