CAP1 cheat sheet

The Risk Management Framework has seven steps in order: Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor.

Risk is a function of the likelihood of a threat event and the adverse impact if it occurs; SP 800-30 assesses threat, vulnerability, likelihood, impact, and resulting risk.

FIPS 199 categorizes information and information systems as low, moderate, or high for confidentiality, integrity, and availability; the system category is the high water mark of the information types it handles.

FIPS 200 defines minimum security requirements, SP 800-53 provides the control catalog, SP 800-53B provides baselines, and SP 800-53A provides assessment procedures.

Risk management is applied at three tiers: organization (Tier 1), mission and business processes (Tier 2), and information systems (Tier 3).

Risk response options are acceptance, avoidance, mitigation, and transfer or sharing; the authorizing official accepts residual risk on behalf of the organization.

Key roles: authorizing official (accepts risk), system owner (operates and maintains), ISSO (implements and monitors), security control assessor (assesses), CISO (program oversight), mission or business owner (defines needs).

Privacy risk is the potential for adverse effects from processing PII; SP 800-53 privacy controls (PT family) and privacy impact assessments address it.

Governance integrates risk management with strategic planning, enterprise architecture, capital planning, and the SDLC so controls are funded and built in rather than added later.

The authorization boundary comprises all system components, users, data, facilities, and interconnections under one risk management authority covered by a single authorization decision.

Boundary scoping uses FIPS 199 categorization, SP 800-60 information-type mapping, and data-flow analysis to decide what is inside and outside the boundary.

Common controls are implemented by an organizational provider and inherited; system-specific controls are implemented inside the boundary; hybrid controls are shared between the two.

Interconnections must be documented with an ISA or MOU defining data flows, security requirements, and the responsibilities of each connected organization.

An enclave is a subset of a system with a defined boundary and common policy, used to scope assessment and authorization activities.

Hardware, software, and data inventories plus network diagrams define the environment of operation and support boundary documentation in the security plan.

External systems the boundary depends on, such as cloud providers or shared services, are recorded as leveraged dependencies rather than silently excluded.

Categorization is confirmed during the Prepare step and re-examined whenever changes could alter impact levels or boundary composition.

Control selection starts from the SP 800-53B baseline matching the FIPS 199 impact level: low, moderate, or high.

Tailoring consists of scoping, parameterization (assigning values to control parameters), applying compensating controls, and adding supplemental controls.

Scoping removes baseline controls that do not apply to the technology or environment of operation; each removal must be justified and documented.

Overlays such as CNSSI 1253 for national security, FedRAMP, and privacy overlays modify a baseline for a specific community, mission, or technology.

Controls are allocated to the organization (common), the system (system-specific), or both (hybrid), and the allocation is recorded in the security plan.

The authorizing official approves the security plan containing the tailored control set, and significant tailoring decisions are documented with rationale.

SP 800-53 organizes controls into 20 families: AC, AT, AU, CA, CM, CP, IA, IR, MA, MP, PE, PL, PM, PS, PT, RA, SA, SC, SI, and SR.

Supplemental controls are added beyond the baseline when assessment results or risk analysis show the baseline does not sufficiently reduce risk.

Implementation is documented in the system security plan, which records each control's status (implemented, partially implemented, planned, or alternative) and how it is satisfied.

Common control providers document implementation and supply evidence to inheriting systems, and that inheritance must be recorded in each system's security plan.

Compensating controls may be used when a required control is not feasible; they must provide equivalent protection and be justified and approved.

Controls are implemented within SDLC and configuration and change management processes so that changes are evaluated for security impact before deployment.

Control parameter values chosen during selection are applied in actual configurations and reflected in the security plan documentation.

Privacy controls such as notice, consent, minimization, retention limits, and safeguards are implemented alongside security controls wherever PII is processed.

Implementation evidence includes configuration settings, procedures, diagrams, and logs, which assessors later examine during assessment.

Controls that remain planned or unimplemented are documented as weaknesses and entered into the plan of action and milestones.

SP 800-53A assessment procedures define assessment objectives and three methods: examine, interview, and test.

The assessment plan defines scope, controls and samples, methods, evidence objects, schedule, and assessor roles, and is approved by the authorizing official or designee.

Assessor independence increases credibility: self-assessment is least independent, while an independent third-party assessment is most independent.

The security assessment report documents results, including control effectiveness determinations and identified weaknesses, and supports the authorization decision.

Findings are ranked by risk, and weaknesses are entered into the POA&M with remediation actions, owners, and milestones.

Assessment depth and coverage are set through sampling, with higher-impact systems generally requiring greater coverage and more rigorous methods.

Vulnerability scanning and penetration testing supplement control assessment by testing whether weaknesses are exploitable.

Assessment of inherited controls relies on evidence supplied by the common control provider, which the assessor reviews for sufficiency.

The authorizing official's decision options are authorization to operate (ATO), interim authorization to operate (IATO), and denial of authorization.

The authorization package contains the security plan, security assessment report, plan of action and milestones, and the authorization decision document.

The authorizing official accepts residual risk, basing the decision on assessed control effectiveness weighed against mission need.

An interim authorization to operate is time-limited and requires identified weaknesses to be remediated by specified dates.

Authorization must be re-reviewed when a significant change occurs or when continuous monitoring shows risk has risen beyond the accepted level.

An authorization is system-specific and does not automatically extend to new interconnections, new environments, or major upgrades.

Under FedRAMP, a Joint Authorization Board provisional ATO (P-ATO) can be leveraged by agencies that then issue their own ATO.

The authorization decision document records the decision, the risk accepted, and any conditions or terms attached to the approval.

Continuous monitoring maintains ongoing awareness of control effectiveness, vulnerabilities, and system changes to support ongoing authorization.

ISCM activities include defining metrics, collecting and analyzing data, responding to findings, and reporting status to the authorizing official.

Monitoring frequency is risk-based: higher-impact systems and volatile controls are monitored more frequently and in greater depth.

A significant change - new boundary, new interconnection, new technology, or major upgrade - triggers reassessment and possible reauthorization.

POA&M items are tracked to closure, and open weaknesses are reported to the authorizing official and in FISMA and OMB reporting.

Automated tools such as vulnerability scanners, SIEM platforms, and continuous diagnostics and mitigation (CDM) supplement periodic control assessments.

The continuous monitoring strategy is documented in the security plan and approved by the authorizing official.

Annual FISMA reporting and OMB cyber metrics summarize monitoring results for external oversight.