You work as a security engineer for BlueWell Inc.
Which of the following documents will you use as a guide for the security certification and accreditation of Federal Information Systems -
Click on the arrows to vote for the correct answer
A. B. C. D.B.
As a security engineer for BlueWell Inc., you will use NIST Special Publication 800-37 as a guide for the security certification and accreditation of Federal Information Systems.
NIST Special Publication 800-37, "Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach," provides a structured, risk-based approach to the security certification and accreditation process for federal information systems. It outlines a six-step process for security certification and accreditation, including initiation, security categorization, security control selection, security control implementation, security control assessment, and authorization to operate (ATO).
The document also emphasizes the importance of risk management throughout the security certification and accreditation process, with a focus on identifying, assessing, and mitigating risks to the confidentiality, integrity, and availability of information systems. It also includes guidelines for implementing security controls based on NIST Special Publication 800-53, "Security and Privacy Controls for Federal Information Systems and Organizations," which provides a catalog of security controls that can be tailored to meet specific organizational and system requirements.
In contrast, NIST Special Publication 800-59, "Guidance for Identifying an Information System as a National Security System," provides guidance for identifying information systems that are deemed critical to national security and require additional security measures beyond those required for non-national security systems.
NIST Special Publication 800-60, "Guide for Mapping Types of Information and Information Systems to Security Categories," provides guidance on mapping different types of information and information systems to security categories based on the impact level of a potential security breach.
Therefore, the correct answer to the question is B. NIST Special Publication 800-37.