I85PREP
⌘ K
NSPM-C study materials
NSPM-C study resources

NSPM-C: NIST Security and Privacy Management

NSPM-C · Work through your exam, one topic at a time.

All guide sections

NIST Security and Privacy Management

NIST Security and Privacy Management

This domain tests how you use the NIST risk management corpus to categorize a system, choose and tailor controls, authorize operation, and fold privacy into the same lifecycle. Expect scenario items that hand you an impact statement and ask which publication governs, which RMF step you are in, or what evidence satisfies an assessor.

Core rules and concepts

  • FIPS 199 rates confidentiality, integrity, and availability separately as low, moderate, or high; the system's overall impact is the high-water mark across the three, not an average.
  • FIPS 200 states minimum security requirements; SP 800-53 Rev. 5 supplies the control catalog in 20 families, including PT (personally identifiable information processing and transparency) and SR (supply chain risk management).
  • SP 800-53B holds the Low, Moderate, High, and Privacy baselines; baselines are starting points that must be scoped, tailored, and supplemented.
  • RMF (SP 800-37 Rev. 2) has seven steps: Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor.
  • SP 800-30 governs risk assessment; weaknesses that cannot be fixed before authorization go on a POA&M.
  • The NIST Privacy Framework organizes outcomes into Identify-P, Govern-P, Control-P, Communicate-P, and Protect-P; it complements, and does not replace, SP 800-53 privacy controls.

Worked example

A benefits portal stores PII for 40,000 employees. Loss of confidentiality would cause serious harm; integrity and availability loss would cause only limited harm. FIPS 199 gives C moderate, I low, A low, so the system is Moderate overall. You start from the SP 800-53B Moderate baseline, apply scoping guidance to remove controls with no applicable technology, add PT-2 (purpose specification) and PT-3 (consent) because PII is processed, assess against SP 800-53A, issue an authorization decision, and place residual risk in the continuous monitoring plan.

Traps that cost marks

  • Averaging FIPS 199 ratings instead of taking the high-water mark.
  • Treating a baseline as a fixed checklist; tailoring and supplementation are expected.
  • Reporting an unmitigated finding as closed when it belongs on a POA&M with an owner and milestone.
  • Mixing Privacy Framework functions with SP 800-53 PT controls in one answer.