Rmf Step 1
21 community-sourced questions and answers. Free — no login.
Risk Management Framework (RMF) is the unified information security framework for the entire federal government that is replacing the legacy DIACAP (DoD Information Assurance Certification and Accreditation Process) processes within federal government departments and agencies, the Department of Defense (DOD) and the Intelligence Community (IC).
What is RMF?
DIACAP is the certification and accreditation (C&A) process that was implemented in 2006 replacing DITSCAP. DIACAP has now been replaced by the RMF process.
What is DIACAP?
Step 1 - CATEGORIZE System Step 2 - SELECT Security Controls Step 3 - IMPLEMENT Security Controls Step 4 - ASSESS Security Controls Step 5 - AUTHORIZE Systems Step 6 - MONITOR Security Controls
What are the steps in the RMF process?
Security categorization is determining and assigning the appropriate values to information or an information system based on protection needs.
What is Security Categorization?
Low, Moderate or High reflecting the potential impact should a security breach occur, such as a loss of confidentiality, integrity or availability.
The Security Categorization method uses three impact values: ___________, __________________ and ___________.
Information Type
A ________ ________ is considered any specific category of information defined by an organization or, in some instances, by a public law, executive order, directive, policy, or regulation.
Information Types
Privacy Information or PII, Medical, Proprietary and Financial are all examples of _____________________ _____________________.
commensurate
System information such as network routing tables, password files, cryptographic key management information, must be protected at a level __________________________ with the most critical or sensitive user information being processed.
NIST SP 800-60
Please refer to NIST SP _______ Volume I from August 2008 for more information related to information type and mapping types of information in information systems to security categories,.
1. Categorize Information System 2. Describe the Info System 3. Register System
What are the three tasks that comprise Step 1 of the RMF?
Information System Owner
The ____________________ ____________________ ____________________________has primary responsibility for all three tasks that comprise Step 1 of RMF.
Information Types, Impact values and Rationale for Decisions.
Information to be documented in the security plan: _________________________ , ______________________ and _____________________.
supporting
The Risk Executive, the Authorizing Official, the CIO, the SISO and the ISSO have __________________ roles in the RMF process.
Authorizing Official
The Designated Accrediting Authority, or DAA under DIACAP is now known as the ________________ _________________ under RMF.
TRUE
Security Categorization is the process of determining and assigning appropriate values to information or an information system based on protection needs. (True or False)
Select security controls
Which of the following is NOT one of the tasks that are part of the first step of the RMF Process? - Register the information system - Select security controls - describe the information system - Categorize the information system
FALSE
Confidentiality is guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity. (True or False)
Information Systems
What must be categorized first in the security categorization process? - Security controls - Information Systems - Impact Values - User Roles
Categorize the system
The first step in the RMF process is to: - Monitor Security Controls - Categorize the system - Assess security controls - select security controls
Moderate
The potential impact is ____________ if the loss of confidentiality, integrity, or availability could be expected to have a serious adverse effect on organizational operations, organizational assets, individuals, other organizations, or the national security interests of the United States. - Low - Moderate - High - None of the Above
Identify common controls
All but ONE of the following is important to categorizing the system. - Identify common controls - define system boundary - identify roles and responsibilities - explain how to assign impact values
Looking for a different version?
CBTs get updated every year. Search for the exact version you're taking (e.g. "cyber awareness 2025").
Search all study materials