NIST Cybersecurity Lead Implementer flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

CSF 2.0 Functions

Six Functions: Govern, Identify, Protect, Detect, Respond, Recover. Govern was added in version 2.0 to elevate cybersecurity risk governance, strategy, and supply chain oversight to the same level as technical Functions.

CSF Implementation Tiers

Four tiers: Partial, Risk Informed, Repeatable, Adaptive. They characterize the rigor of an organization's cybersecurity risk governance and management processes, not the maturity of individual controls or a pass/fail rating.

CSF Profiles

A Current Profile describes outcomes currently achieved; a Target Profile describes desired outcomes. The gap between them drives prioritized remediation and investment. Community Profiles are published baselines for a sector.

RMF Seven Steps

Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor per NIST SP 800-37 Rev. 2. Prepare was added in Rev. 2 and establishes context, priorities, and resources before system categorization begins.

FIPS 199 Categorization

Assigns Low, Moderate, or High impact to confidentiality, integrity, and availability based on harm to operations, assets, or individuals. The system's overall category is the high-water mark across the three objectives.

SP 800-53 Control Families

Rev. 5 defines 20 families identified by two-letter codes such as AC, AU, CM, IA, IR, RA, SC, SI. Rev. 5 added PT for PII processing and SR for supply chain risk management.

Security Control Baseline

The set of controls selected for a system based on its FIPS 199 impact level and any overlays. Baselines are starting points; tailoring removes, supplements, or compensates controls with documented justification.

Authorization Package Contents

System security plan, security assessment report, plan of action and milestones, and the authorization decision. The authorizing official accepts residual risk and signs the authorization to operate.

Program Charter Essentials

Names the accountable executive, defines scope and boundaries, delegates authority, and sets the reporting line. Without a named accountable owner, risk acceptance decisions cannot be enforced or audited.

Three Lines Model

First line owns and operates controls; second line sets policy and oversees risk; third line, internal audit, provides independent assurance. The lead implementer usually operates in the first or second line.

Policy Hierarchy

Policy states mandatory intent; standards specify mandatory requirements; procedures give step-by-step instructions; guidelines are recommended. Exceptions to policy require documented, time-bound risk acceptance by an authorized owner.

Metric Versus Indicator

Metrics are lagging and outcome-based, such as mean time to remediate. Indicators are leading and predictive, such as patch SLA compliance rate. Programs need both to steer and to report results.

POA&M Entry Elements

Requires weakness description, root cause, responsible owner, milestone dates, required resources, and risk rating. Open POA&M items are the primary evidence used in authorization and continuous monitoring decisions.

Awareness Program Measurement

Measure behavior change, not training hours: phishing simulation click rates, report rates, policy attestation completion, and repeat-offender trends. Hours delivered indicate activity, not effectiveness.

RTO and RPO

Recovery time objective is the maximum tolerable time to restore a process; recovery point objective is the maximum tolerable data loss measured in time. Both are business-owned inputs to continuity planning.

Vendor Risk Tiering

Classify third parties by data sensitivity and system access. Higher tiers require stronger contract clauses, breach notification terms, audit rights, and more frequent reassessment proportional to the risk.

Change Management Control

Documented approval before production change, with testing evidence, rollback plan, and post-implementation review. Emergency changes require retroactive approval and are logged for audit review.

Least Privilege

Grant only the access needed for the role and task, using unique user IDs and role or attribute-based assignment. Shared accounts destroy accountability and weaken audit trail integrity.

Authenticator Assurance Levels

NIST SP 800-63B defines AAL1, AAL2, AAL3. AAL3 requires phishing-resistant, hardware-based authenticators. SMS one-time passwords are classified as restricted authenticators and are discouraged for high-assurance access.

FIPS 140-3 Validation

Cryptographic modules used in federal systems should be validated to FIPS 140-3. Validation covers approved algorithms, module boundary, key management, and self-tests, and is evidenced by a certificate number.

TLS Minimum Configuration

Require TLS 1.2 minimum and prefer TLS 1.3; disable SSL and TLS 1.0/1.1; deprecate SHA-1 signatures. Use certificates from a trusted authority and enforce certificate validation on clients.

Audit Log Protection

Centralize logs, synchronize to a trusted time source, restrict access, and protect integrity against modification. Retention must satisfy legal, regulatory, and contractual requirements, and events must be reviewed and reported.

Risk-Based Patching

Remediation timelines scale with exposure and exploitability: internet-facing critical vulnerabilities in days, internal moderate findings in weeks. Track SLA adherence as a key performance indicator.

Secure Configuration Baseline

Documented, approved settings for each system type, with drift detection and change control. Deviations require documented justification and compensating controls, and baselines are reviewed on a defined cycle.

Incident Response Lifecycle

Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity. Lessons learned from the final phase feed back into risk assessment and control improvement.

Media Sanitization Levels

NIST SP 800-88 defines Clear, Purge, and Destroy. Selection depends on data sensitivity, media type, and reuse intent; destruction is required when purge cannot achieve acceptable residual risk.

Risk Treatment Options

Exactly four: mitigate, transfer, avoid, accept. Residual risk after treatment must be explicitly accepted by an owner with authority, and acceptance must be documented and time-bound.

Annualized Loss Expectancy

ALE equals single loss expectancy multiplied by annualized rate of occurrence; SLE equals asset value multiplied by exposure factor. ALE supports cost-benefit comparison of proposed safeguards.

Risk Register Contents

Asset or process, threat, vulnerability, existing controls, inherent risk, residual risk, treatment plan, owner, and review date. It is the living record linking risk decisions to remediation work.

800-30 Assessment Steps

Prepare for assessment; conduct assessment by identifying threat sources and events, vulnerabilities, likelihood, impact, and risk; communicate results; maintain the assessment through ongoing monitoring and updates.

Control Crosswalk

A mapping showing how one control satisfies requirements across multiple frameworks, such as CSF, SP 800-53, and ISO 27001. Crosswalks prevent duplicate controls and reduce audit burden.

Continuous Monitoring

RMF step seven: ongoing control assessments, defined metrics, and change-driven reassessment. Authorization is time-bound, not permanent, and must be re-examined at defined intervals or after significant change.