CISSP-ISSEP: Information Systems Security Engineering Professional

Question

You are a security manager for BlueWell Inc. and are working through the NIST SP 800-37 C&A methodology, which is based on four clearly defined phases. In which phase of the NIST SP 800-37 C&A methodology does security categorization take place?

Explanation

Security categorization occurs during the Initiation phase. It establishes the system’s impact level and risk context before security controls are selected, assessed during certification, and accepted during accreditation.

Learn more

NIST SP 800-37: Guide for the Security Certification and Accreditation of Federal Information Systems

CISSP-ISSEP: Information Systems Security Engineering Professional

AstroTutor

Notes

Readiness

QuestionQ54

Community Discussion