CAP (The American College Credentials) flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

RMF seven steps

Per NIST SP 800-37 Rev. 2, the steps are Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor. Prepare was added in Revision 2 to address readiness activities before categorization.

Three-tiered risk management

NIST SP 800-39 defines Tier 1 organization-level governance, Tier 2 mission and business processes, and Tier 3 information system management. The RMF operates at Tier 3 within Tier 1 and Tier 2 direction.

Authorizing Official responsibilities

A senior official who accepts risk on behalf of the organization, reviews the authorization package, determines residual risk, and signs the authorization decision for a system.

Prepare step activities

Added by SP 800-37 Rev. 2, this step assigns roles, sets the risk management strategy, identifies the authorization boundary, allocates common controls, and establishes organization-wide security and privacy posture.

Security Control Assessor

The individual or team that assesses security and privacy controls, produces the security assessment report, and reports findings to the authorizing official. Independence from the system team is required.

FIPS 199 impact levels

FIPS 199 defines three potential impact levels-low, moderate, and high-assigned separately to confidentiality, integrity, and availability for a federal information system.

High-water mark rule

Under FIPS 199, the overall security category of an information system equals the highest impact value among its assigned confidentiality, integrity, and availability categories.

Security category notation

Expressed as SC system = {(confidentiality, moderate), (integrity, moderate), (availability, low)}, pairing each security objective with its assigned FIPS 199 impact level.

SP 800-60 purpose

NIST SP 800-60 Volumes 1 and 2 provide guidance and provisional mappings from information types to confidentiality, integrity, and availability impact levels used during FIPS 199 categorization.

Moderate impact definition

FIPS 199 defines moderate impact as a serious adverse effect on organizational operations, organizational assets, or individuals, such as significant degradation of mission capability or serious financial loss.

FIPS 200 minimum requirements

This standard specifies minimum security requirements for federal information and systems across 17 security-related areas, satisfied by selecting controls from the NIST SP 800-53 catalog.

SP 800-53B baselines

NIST SP 800-53B contains the low, moderate, and high control baselines drawn from the SP 800-53 catalog, plus privacy baselines and tailoring guidance used when selecting controls.

Control identifier format

Control identifiers combine a family abbreviation with a number, such as AC-2 for Account Management; enhancements append a parenthetical number, such as AC-2(1) for Automated System Account Management.

Tailoring baselines

Tailoring adjusts a baseline by scoping out inapplicable controls, setting organization-defined parameters, applying compensating controls, and supplementing controls to address specific risks or requirements.

Common control

A security control implemented by an organizational entity and inherited by multiple information systems; the common control provider documents the implementation and supplies evidence to inheriting systems.

SP 800-18 security plan

This NIST guide describes how to build the system security plan, which documents the authorization boundary, system environment, selected controls, implementation status, and control descriptions.

Implementation status values

Security plans record each control as implemented, partially implemented, planned, or not applicable, along with a description of how the control is satisfied and what evidence exists.

Hybrid control

A control implemented partly as a common control by an organizational entity and partly within the system itself, requiring documentation from both the common control provider and the system owner.

SP 800-70 checklists

This NIST publication describes security configuration checklists and the Security Content Automation Protocol for verifying and automating configuration settings that support control implementation.

Assessment methods

SP 800-53A defines three methods: examine (review documents, logs, configurations), interview (discuss with personnel), and test (exercise or scan the mechanism under specified conditions).

Assessment determinations

Each SP 800-53A assessment yields a determination of satisfied or other than satisfied for the control, supported by assessment objectives, collected evidence, and any identified deficiencies.

Security assessment report

The SAR documents assessment scope, methods, findings, and control-by-control results; with the security plan and POA&M it forms the authorization package reviewed by the authorizing official.

Assessor independence

The security control assessor must be free of the system's development, operation, and management so results are objective and unbiased enough to support the authorizing official's risk decision.

SP 800-115 scope

This NIST technical guide covers information security testing and assessment, including planning, discovery, attack, and post-testing activities such as vulnerability scanning and penetration testing.

Authorization package contents

The three documents the authorizing official reviews before deciding: the system security plan, the security assessment report, and the plan of action and milestones.

Authorization to Operate

A formal decision by the authorizing official that a system may operate with acceptable residual risk, documented in a signed authorization memorandum stating terms and conditions.

Denial of Authorization to Operate

An authorizing official's decision that a system may not operate because risk is unacceptable; the system must remediate deficiencies or be shut down, with limited interim authority possible.

Delegated Authorizing Official

An official to whom the authorizing official formally delegates, in writing, authority to make an authorization decision for a specific system, while retaining accountability for the accepted risk.

ISCM definition

Information security continuous monitoring, defined in NIST SP 800-137, maintains ongoing awareness of threats, vulnerabilities, and control effectiveness to support organizational risk decisions.

ISCM process steps

Per SP 800-137: define the strategy, establish the program, implement the program, analyze and report findings, respond to findings, and review and update the strategy and program.

Significant change

A change likely to affect the system's security posture, such as new interfaces, altered architecture, or a changed categorization, triggering a security impact analysis and possible reauthorization.

Plan of Action and Milestones

A management document listing known control weaknesses with planned remediation actions, responsible parties, and milestone dates; it is updated during continuous monitoring and included in the authorization package.