Risk Management Framework Final Exam Study Guide | Questions with 100% Correct Answers | Verified | Latest Update 2024

Which of the following documents do NOT give specific guidance on selecting or defining security controls? - DOD 5220.22-M Impact values are assigned based on - Potential harm to the nation, organizations, mission, or individuals Who has responsibility for determining which security controls apply to an information system? - Common Control Provider Information Security Architect - incorrect Chief Information Officer or Senior Information Security Officer All of the above The process of modifying an overlay to address increased risk or variation in risk tolerance is known as - Streamlining Interlacing Tailoring Remediating - incorrect Which one of the following is not included in the tasks that are part of the second step of the RMF process? - Categorize the Information System Who has responsibility for updating the security plan and POA&M's based on the results of the continuous monitoring process? - ISO