Question 1

What are the prerequisites for starting the A&A process?

Accepted Answer

Before starting the A&A process, you should review your sponsorship documentation and security classification guidance, review the materials on the DCSA Risk Management Framework (RMF) website, and contact your local Information System Security Professional (ISSP) with any questions or concerns. [Source: CDSE — Applying Assessment & Authorization (A&A) in the National Industrial Security Program (NISP) (CS250.16) Student Guide — "As the Information System Security Manager, or ISSM, for a cleared contractor, there are several tasks you should perform before beginning the A&A process." https://www.cdse.edu/Portals/124/Documents/student-guides/CS250-guide.pdf]

Question 2

What is the significance of the Risk Assessment Report (RAR) in the A&A process?

Accepted Answer

The RAR documents the results of the risk and threat assessment and influences the selection of security controls used to mitigate the risk associated with the Information System. [Source: CDSE — Applying Assessment & Authorization (A&A) in the National Industrial Security Program (NISP) (CS250.16) Student Guide — "The RAR documents the results of the risk and threat assessment." https://www.cdse.edu/Portals/124/Documents/student-guides/CS250-guide.pdf]

Question 3

What are the three main outputs of the Categorize Step?

Accepted Answer

The three main outputs of the Categorize Step are a System Description, an updated NISP eMASS System Record, and the System Categorization. [Source: CDSE — Applying Assessment & Authorization (A&A) in the National Industrial Security Program (NISP) (CS250.16) Student Guide — "Categorize Step results in the creation of three main items: a System Description, an updated NISP eMASS System Record, and the System Categorization." https://www.cdse.edu/Portals/124/Documents/student-guides/CS250-guide.pdf]

Question 4

What is the role of the Information Owner (IO) during the Categorize Step?

Accepted Answer

The IO is the authority for determining categorization and must be involved in the process of categorizing the data and system. [Source: CDSE — Applying Assessment & Authorization (A&A) in the National Industrial Security Program (NISP) (CS250.16) Student Guide — "The categorization of the data and system must be coordinated with the IO." https://www.cdse.edu/Portals/124/Documents/student-guides/CS250-guide.pdf]

Question 5

What types of security controls are defined in the Select Step?

Accepted Answer

The types of security controls defined in the Select Step are system-specific, common, and hybrid controls. [Source: CDSE — Applying Assessment & Authorization (A&A) in the National Industrial Security Program (NISP) (CS250.16) Student Guide — "There are three types of security controls: system specific, common, and hybrid." https://www.cdse.edu/Portals/124/Documents/student-guides/CS250-guide.pdf]

Question 6

What is the purpose of continuous monitoring in the Select Step?

Accepted Answer

Continuous monitoring is used to determine whether the planned security control implementation is acceptable and includes configuration management and control, security impact analyses on proposed changes, assessment of selected security controls, and security status reporting. [Source: CDSE — Applying Assessment & Authorization (A&A) in the National Industrial Security Program (NISP) (CS250.16) Student Guide — "Continuous monitoring is a critical part of risk management and is used to determine whether the planned security control implementation is acceptable." https://www.cdse.edu/Portals/124/Documents/student-guides/CS250-guide.pdf]

Question 7

What is the final task of the System Level Prepare Step?

Accepted Answer

The final task is registering the system in the NISP eMASS instance. [Source: CDSE — Applying Assessment & Authorization (A&A) in the National Industrial Security Program (NISP) (CS250.16) Student Guide — "This was the final system level task." https://www.cdse.edu/Portals/124/Documents/student-guides/CS250-guide.pdf]

Question 8

What is the DCSA baseline categorization for Information Systems seeking authorization?

Accepted Answer

The DCSA baseline categorization is a Moderate impact due to loss of confidentiality and a Low impact due to loss of integrity or availability. [Source: CDSE — Applying Assessment & Authorization (A&A) in the National Industrial Security Program (NISP) (CS250.16) Student Guide — "The DCSA baseline categorization is a Moderate impact due to loss of confidentiality and a Low impact due to loss of integrity or availability." https://www.cdse.edu/Portals/124/Documents/student-guides/CS250-guide.pdf]

Question 9

What is the role of the ISSM in the Implement Step?

Accepted Answer

The ISSM implements the security controls identified in the Security Control Selection and documents the implementation while looking for any weaknesses. [Source: CDSE — Applying Assessment & Authorization (A&A) in the National Industrial Security Program (NISP) (CS250.16) Student Guide — "In this step, the ISSM implements the security controls identified in the Security Control Selection." https://www.cdse.edu/Portals/124/Documents/student-guides/CS250-guide.pdf]

Question 10

What is the purpose of tailoring security controls in the Select Step?

Accepted Answer

Tailoring security controls allows the ISSM to supplement the baseline with additional controls or to remove controls that do not apply or are satisfied by mitigating factors, providing justification in the security plan. [Source: CDSE — Applying Assessment & Authorization (A&A) in the National Industrial Security Program (NISP) (CS250.16) Student Guide — "In Task S-2, the ISSM tailors the baseline security controls as needed." https://www.cdse.edu/Portals/124/Documents/student-guides/CS250-guide.pdf]

Question 11

What is the significance of the NISP eMASS in the A&A process?

Accepted Answer

NISP eMASS is the government-owned, web-based application that manages the A&A process and is used to populate information and upload artifacts, including generating a Security Plan. [Source: CDSE — Applying Assessment & Authorization (A&A) in the National Industrial Security Program (NISP) (CS250.16) Student Guide — "NISP eMASS is the portal to manage the A&A process." https://www.cdse.edu/Portals/124/Documents/student-guides/CS250-guide.pdf]

applying assessment authorization a a in the

Know questions we're missing?

Want to study these as flashcards?