Fips 199/200

Front 1

What act, passed by the 107th Congress, recognized the importance of information security to the economic and national security interests of the United States?

Back 1

The E-Government Act of 2002 (Public Law 107-347)

Front 2

What does FISMA stand for?

Back 2

Federal Information Security Management Act (of 2002)

Front 3

What does FIPS stand for?

Back 3

Federal Information Processing Standards

Front 4

What does NIST stand for?

Back 4

National Institute of Standards and Technology

Front 5

(T/F) NIST 199 establishes security categories for information, but NOT for information systems.

Back 5

False: NIST 199 establishes security categories for BOTH information AND information systems.

Front 6

Security categories are used in conjunction with what information in assessing the risk of an organization?

Back 6

Security categories are used in conjunction with vulnerability and threat information in assessing the risk to an organization.

Front 7

What is defined as "The unauthorized disclosure of information"?

Back 7

The Loss of Confidentiality

Front 8

The loss of ________ is the unauthorized modification or destruction of information

Back 8

Integrity

Front 9

How is loss of Availability defined?

Back 9

The disruption o f access to or use of information or an information system

Front 10

What is the potential impact on an organization of the loss of confidentiality, integrity, or availability could be expected to have a limited adverse effect on organizational operations, assets, or people?

Back 10

Low

Front 11

If the loss of confidentiality, integrity, or availability could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals, then the potential Impact is ______

Back 11

Moderate

Front 12

The potential impact is High if ________________________

Back 12

The loss of confidentiality, integrity, or availability could be expected to have a severe or catastrophic adverse effect on organizational operations organizational assets or individuals.

Front 13

Define "Executive Agency"

Back 13

An executive department specified in 5 U.S.C., SEC. 101; a military department specified in 5 U.S.C., SEC. 102; an independent establishment as defined in 5 U.S.C., SEC. 104(1); and a wholly owned Government corporation fully subject to the provisions of 31 U.S.C., CHAPTER 91. [41 U.S.C., SEC. 403]

Front 14

Define "Federal Information System"

Back 14

An information system used or operated by an executive agency, by a contractor of an executive agency, or by another organization on behalf of an executive agency. [40 U.S.C., SEC. 11331]

Front 15

Define "Information"

Back 15

An instance of an information type.

Front 16

Define "Information Resources"

Back 16

Information and related resources, such as personnel, equipment, funds, and information technology. [44 U.S.C., SEC. 3502]

Front 17

The protection of information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide confidentiality, integrity, and availability.

Back 17

INFORMATION SECURITY

Front 18

A discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information

Back 18

INFORMATION SYSTEM

Front 19

INFORMATION TYPE

Back 19

A specific category of information (e.g., privacy, medical, proprietary, financial, investigative, contractor sensitive, security management), defined by an organization, or in some instances, by a specific law, Executive Order, directive, policy, or regulation

Front 20

Guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity

Back 20

INTEGRITY

Front 21

The characterization of information or an information system based on an assessment of the potential impact that a loss of confidentiality, integrity, or availability of such information or information system would have on organizational operations, organizational assets, or individuals

Back 21

SECURITY CATEGORY

Front 22

SECURITY CONTROLS

Back 22

The management, operational, and technical controls (i.e., safeguards or countermeasures) prescribed for an information system to protect the confidentiality, integrity, and availability of the system and its information.

Front 23

SECURITY OBJECTIVES

Back 23

Confidentiality, integrity, and availability.

Front 24

What is an information system considered to be if all three security objectives are LOW (L-L-L)?

Back 24

A Low Impact System

Front 25

What is an information system considered to be if at least one of the objectives is Moderate and none of the objectives is greater than Moderate (L-L-M, L-M-M, L-M-L, M-M-L, M-L-L, M-M-M)?

Back 25

A Moderate Impact System

Front 26

(T/F) The determination of information system impact levels MUST be accomplished prior to the consideration of minimum security requirements and the selection of appropriate security controls for those information systems

Back 26

TRUE

Front 27

How many security- related areas with regard to protecting confidentiality, integrity and availability are covered by "The Minimum Security Requirements"?

Back 27

Seventeed

Front 28

What are the seventeen areas covered by "The Minimum Security Requirements"?

Back 28

Access Control (AC)
Awareness and Training (AT)
Audit and Accountability (AU)
Certification, Accreditation, and Security Assessments (CA)
Configuration Management (CM)
Identification and Authentication (IA)
Incident Response (IR)
Maintenance (MA)
Media Protection (MP)
Physical and Environmental Protection (PE)
Planning (PL)
Personnel Security (PS)
Risk Assessment (RA)
System and Services Acquisition (SA)
System and Communications Protection (SC)
System and Information Integrity (SI)