Federal Government Information Security - Chapter 8

<p>A website experiences a temporary outage due to planned maintenance. (A)</p> Signup and view all the answers

<p>US-CERT (D)</p> Signup and view all the answers

<p>To allow the NCCIC to track and analyze incident trends across federal agencies. (A)</p> Signup and view all the answers

<p>It results in the loss of a significant amount of data. (B)</p> Signup and view all the answers

<p>Employee violations of acceptable use policies. (A)</p> Signup and view all the answers

<p>Conducting independent and objective audits, investigations, and inspections to detect and prevent waste, fraud, and abuse. (D)</p> Signup and view all the answers

<p>Developing and implementing agency strategic plans. (D)</p> Signup and view all the answers

<p>The president nominates them, and the Senate approves them. (A)</p> Signup and view all the answers

<p>Only the president can remove them. (C)</p> Signup and view all the answers

<p>The Department of Commerce (DOC) (A)</p> Signup and view all the answers

<p>Creating information security standards and guidelines for federal agencies. (B)</p> Signup and view all the answers

<p>To prevent IGs from being influenced by partisan politics and making decisions based on personal agendas. (A)</p> Signup and view all the answers

<p>SP 800-53, Revision 6 (D)</p> Signup and view all the answers

<p>To define the role and responsibilities of Inspector Generals (IGs) in federal agencies. (D)</p> Signup and view all the answers

<p>To provide guidance on security control decisions for federal information systems. (A)</p> Signup and view all the answers

<p>An event that causes severe or catastrophic harm to the agency, its assets, or people. (D)</p> Signup and view all the answers

<p>The security category assigned to an agency influences the types of security controls that are considered appropriate. (B)</p> Signup and view all the answers

<p>Late 2020 or early 2021 (A)</p> Signup and view all the answers

<p>Data encryption (D)</p> Signup and view all the answers

<p>The Federal Register (B)</p> Signup and view all the answers

<p><a href="https://www.nasa.gov/content/nasa-privacy-act-system-of-records-notices-sorns">https://www.nasa.gov/content/nasa-privacy-act-system-of-records-notices-sorns</a> (A)</p> Signup and view all the answers

<p>Agencies are expected to refer to these documents for guidance while making their security control decisions. (C)</p> Signup and view all the answers

<p>It provides a comprehensive framework for security and privacy controls, including major enhancements from prior revisions. (C)</p> Signup and view all the answers

<p>$1,000 (B)</p> Signup and view all the answers

<p>$5,000 (C)</p> Signup and view all the answers

<p>Failure to comply with a Freedom of Information Act (FOIA) request. (B)</p> Signup and view all the answers

<p>Misdemeanor (C)</p> Signup and view all the answers

<p>To protect the privacy of individuals by limiting the government’s collection, use, and disclosure of personal information. (C)</p> Signup and view all the answers

<p>An external auditor (D)</p> Signup and view all the answers

<p>To gauge an agency's compliance with information security best practices and regulations (B)</p> Signup and view all the answers

<p>Privacy activities (D)</p> Signup and view all the answers

<p>To review and assess the agency's performance and compliance with regulations (D)</p> Signup and view all the answers

<p>To demonstrate compliance with relevant regulations (D)</p> Signup and view all the answers

<p>Annually (D)</p> Signup and view all the answers

<p>To assess if organizations are meeting their stated goals and objectives in information security and privacy (B)</p> Signup and view all the answers

<p>Developing and publishing annual security questions for agencies to answer (A)</p> Signup and view all the answers

<p>When the disclosure is made for statistical research or reporting, and all personally identifiable data has been removed. (B), When the disclosure is made to a federal agency employee who needs the record to perform his or her job duties. (D)</p> Signup and view all the answers

<p>Disclosure to a private company for marketing purposes. (C)</p> Signup and view all the answers

<p>When the agency requests the record for an ongoing criminal investigation. (B)</p> Signup and view all the answers

<p>Disclosure to the U.S. Census Bureau to perform a survey. (B)</p> Signup and view all the answers

<p>When the disclosure is made to protect the health or safety of an individual. (A)</p> Signup and view all the answers

<p>To disclose a record under the Freedom of Information Act. (C)</p> Signup and view all the answers

<p>Disclosure for routine use by the agency that maintains the record. (D)</p> Signup and view all the answers

<p>Disclosure to the U.S. Comptroller General for an oversight function. (C)</p> Signup and view all the answers

A set of questions asked to assess agency security practices.

Programs to educate agency staff on privacy regulations and protocols.

Guidelines on how to inform individuals about data breaches.

Personally Identifiable Information that must be protected.

An external assessment of an agency's information security program.

An official who reviews federal agencies for efficiency and compliance.

An independent entity hired to evaluate an agency's security program.

Strategies to minimize the unnecessary use of Social Security Numbers.

No need for written consent for certain record disclosures.

Records can be disclosed to federal employees for job duties without consent.

Disclosure required under the Freedom of Information Act.

Records may be disclosed for an agency’s routine use.

Disclosures made to the U.S. Census Bureau for surveys.

Records may be shared for statistical research after removing identifiers.

Records can be disclosed to the National Archives for historical value.

Disclosure to protect a person’s health or safety without consent.

A center that supports agencies in managing information security incidents under FISMA.

National Cybersecurity and Communications Integration Center; where agencies report security incidents.

United States Computer Emergency Readiness Team; another name for the federal IR center.

Federal Information Security Management Act; requires federal agencies to secure information systems.

An event that risks the integrity, confidentiality, or availability of information.

Employee actions that break a federal agency's established security rules.

The process of identifying and evaluating potential threats to information security.

The evaluation of potential risks that agencies must consider to enhance security.

System of Records Notice, informing about data collection by agencies.

The official journal of the federal government where announcements are published.

Unauthorized access or failure to amend records under the Privacy Act.

Individuals can sue agencies for Privacy Act violations.

Courts can award damages for intentional Privacy Act violations.

Federal agency employees can face criminal charges for violations.

Employees can be fined up to $5,000 for leaking information.

Agencies must post their SORNs online, enhancing transparency.

An event causing severe damage to an agency's assets, confidentiality, integrity, or availability.

National Institute of Standards and Technology, providing frameworks for information security.

Document detailing minimum security requirements for federal information systems.

NIST document outlining security and privacy controls for federal organizations.

Choices agencies make about implementing security measures.

Areas where agencies must specify security controls according to FIPS 200.

Upcoming update to SP 800-53 with enhanced security controls.

Mechanisms to restrict who can view or use information resources.

Legislation that defines the role and responsibilities of IGs.

Evaluations conducted by IGs free from agency influence.

The effort made by IGs to detect and stop dishonest activities.

NIST develops information security standards as required by FISMA.

IGs are nominated by the president and confirmed by the Senate.

Only the president has the authority to remove an IG.