Risk Management Framework Control Selection

Study Notes

Select Tasks and Expected Outcomes in RMF

Task S-1: Control Selection
- Select control baselines addressing system protection based on assessed risks.
- Relevant framework: Cybersecurity Framework Profile.
Task S-2: Control Tailoring
- Tailor selected controls to create customized control baselines reflecting specific system needs.
- Inputs include initial control baselines and organizational policies.
Task S-3: Control Allocation
- Designate controls as system-specific, hybrid, or common.
- Allocate controls to system components: machine, physical, or human elements.
- Utilizes inputs like organizational policy on system registration.
Task S-4: Documentation of Planned Control Implementations
- Document tailored controls and their implementations in security and privacy plans.
- Ensure thorough recording of all controls for compliance and tracking.
Task S-5: Continuous Monitoring Strategy – System
- Develop a strategy for ongoing control effectiveness monitoring aligned with organizational policies.
- Integrates continuous monitoring with time-based triggers for authorization.
Task S-6: Plan Review and Approval
- Review and approve security and privacy plans that reflect necessary control selections.
- Ensures authorizing officials validate plans align with risk management strategies.

Inputs and Outputs for Each Task

Control Selection (TASK S-1)
- Inputs: Security categorization, risk assessment results, system component inventory, business impact analysis, contractual requirements, etc.
- Outputs: Selected controls for the system and operational environment.
Control Tailoring (TASK S-2)
- Inputs: Initial baselines, risk assessments, organizational policies, etc.
- Outputs: List of tailored controls specific to the system and operational context.
Control Allocation (TASK S-3)
- Inputs: Security categorization, policy directives, regulatory requirements, etc.
- Outputs: Allocated security and privacy controls mapped to system elements.
Documentation of Implementations (TASK S-4)
- Inputs: Security categorization, risk assessments, organizational policies, etc.
- Outputs: Comprehensive security and privacy plans documented for the system.
Continuous Monitoring Strategy (TASK S-5)
- Inputs: Organizational risk management strategy and continuous monitoring plans.
- Outputs: Established monitoring strategy ensuring ongoing control effectiveness.
Plan Review and Approval (TASK S-6)
- Inputs: Security and privacy plans reflecting control selections.
- Outputs: Approved plans ensuring alignment with risk management objectives.

Description

This quiz focuses on the key tasks involved in the Risk Management Framework (RMF) regarding the selection and documentation of security controls. It emphasizes the importance of control selection, tailoring, allocation, and continuous monitoring strategies for effective cybersecurity management. Test your understanding of these critical processes and frameworks.