Discuss ISC2 CSSLP Exam Topic 5 Question 109

You work as a security engineer for BlueWell Inc. Which of the following documents will you use as a guide for the security certification and accreditation of Federal Information Systems?

ANIST Special Publication 800-60

BNIST Special Publication 800-53

CNIST Special Publication 800-37

DNIST Special Publication 800-59

Suggested Answer: C

NIST has developed a suite of documents for conducting Certification & Accreditation (C&A). These documents are as follows:

NIST Special Publication 800-37: This document is a guide for the security certification and accreditation of Federal Information

Systems.

NIST Special Publication 800-53: This document provides a guideline for security controls for Federal Information Systems.

NIST Special Publication 800-53A. This document consists of techniques and procedures for verifying the effectiveness of security

controls in Federal Information System.

NIST Special Publication 800-59: This document is a guideline for identifying an information system as a National Security System.

NIST Special Publication 800-60: This document is a guide for mapping types of information and information systems to security

objectives and risk levels.

Get Premium CSSLP Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

27 comments · newest first

Vannessa 5 months ago

But 800-60 is more about categorization, right? Not really for certification.

Marva 5 months ago

I was leaning towards B) NIST Special Publication 800-53. It has great controls.

Pearline 5 months ago

I agree! 800-37 covers the certification process well.

Tegan 6 months ago

I think it's C) NIST Special Publication 800-37. It's all about risk management.

Carlee 6 months ago

I agree, 800-37 is the go-to for this!

Tayna 6 months ago

Wait, are we sure 800-37 is the right one?

Matt 6 months ago

800-60 is more about categorization, not certs.

Rex 6 months ago

I thought it was 800-53? Seems like a solid choice too.

Lorrine 6 months ago

Definitely NIST SP 800-37 for certification!

Felicitas 7 months ago

NIST SP 800-37 is the answer, no doubt. Unless you're a security engineer who's been living under a rock.

Youlanda 7 months ago

NIST SP 800-37 is the document you want. It's like the security certification bible for federal agencies.

Cornell 7 months ago

NIST SP 800-59? Really? That's for identifying and categorizing federal information and information systems. Not what we're looking for here.

Gary 8 months ago

NIST SP 800-60 is the way to go. It's all about defining security categories for information and information systems.

Jade 8 months ago

I'm pretty sure NIST SP 800-53 is the right answer. It covers security controls for federal information systems.

Brittney 8 months ago

NIST SP 800-37 is the correct answer. It provides guidance for the security certification and accreditation of federal information systems.

Kristofer 8 months ago

I’m leaning towards 800-37 too, but I wonder if there’s a chance it could be 800-53 since it’s so widely referenced in security frameworks.

Georgeanna 8 months ago

I feel like 800-60 and 800-59 are related to categorization and guidelines, but I can't recall their exact roles in certification.

Stephen 8 months ago

I remember practicing with a question about NIST documents, and I think 800-53 is more about security controls, not specifically for certification.

Stephane 9 months ago

I think it might be NIST SP 800-37 since it covers the risk management framework, but I'm not entirely sure.

Karl 9 months ago

Alright, time to put my security knowledge to the test. I think the answer is C, NIST SP 800-37. That's the guide that outlines the steps for certifying and accrediting federal information systems, if I'm not mistaken.

Kristeen 9 months ago

I'm a bit unsure on this one. I know NIST has a lot of different publications, and it's hard to keep track of which one covers what. I'll have to review my notes to refresh my memory.

Regenia 9 months ago

Ah, I remember learning about this in class. I'm pretty confident the answer is C, NIST SP 800-37. That's the guide for the security certification and accreditation process.

Kayleigh 9 months ago

Okay, let me think this through. I know 800-53 covers security controls, so that's not the right one. I'm leaning towards C, but I'll double-check the descriptions just to be sure.

Aleta 10 months ago

Hmm, I think 800-37 is the one for security certification and accreditation, but I'm not 100% sure.

Ceola 3 months ago

↳ replying to Aleta

I thought 800-53 was more about controls, though.

Vincent 3 months ago

↳ replying to Aleta

Yeah, it focuses on risk management.

Phil 4 months ago

↳ replying to Aleta

I agree, 800-37 seems right for that.

ISC2 CSSLP Exam - Topic 5 Question 109 Discussion