Security Categorization Phase
Question
You work as a security manager for BlueWell Inc.
You are going through the NIST SP 800-37 C&A methodology, which is based on four well defined phases.
In which of the following phases of NIST SP 800-37 C&A methodology does the security categorization occur?
Answers
Explanations
Click on the arrows to vote for the correct answer
A. B. C. D.D.
The various phases of NIST SP 800-37 C&A are as follows: Phase 1: Initiation- This phase includes preparation, notification and resource identification.
It performs the security plan analysis, update, and acceptance.
Phase 2: Security Certification- The Security certification phase evaluates the controls and documentation.
Phase 3: Security Accreditation- The security accreditation phase examines the residual risk for acceptability, and prepares the final security accreditation package.
Phase 4: Continuous Monitoring-This phase monitors the configuration management and control, ongoing security control verification, and status reporting and documentation.
The NIST SP 800-37 C&A (Certification and Accreditation) methodology is a standardized process that provides guidance for assessing and authorizing the security and privacy controls of federal information systems. The methodology is based on four well-defined phases that include Initiation, Security Categorization, Security Control Selection, and Implementation, Assessment, and Authorization.
The Security Categorization phase is the second phase of the NIST SP 800-37 C&A methodology. In this phase, the security manager identifies and documents the information system and the information processed, stored, and transmitted by the system. The security manager then categorizes the information system according to the potential impact that a security breach or incident could have on the confidentiality, integrity, or availability of the system and the information it processes.
The security categorization phase is a critical phase of the NIST SP 800-37 C&A methodology because it determines the level of security controls that must be implemented and assessed for the information system. The security manager must use the results of the security categorization to select the appropriate security controls from the NIST SP 800-53 control catalog.
To summarize, the Security Categorization phase occurs in the early stages of the NIST SP 800-37 C&A methodology and is a critical step in determining the appropriate security controls that must be implemented and assessed for the information system.
