In 2003, NIST developed a new Certification & Accreditation (C&A) guideline known as FIPS 199.
What levels of potential impact are defined by FIPS 199?
Each correct answer represents a complete solution. Choose all that apply.
Response:

Controls reported by system owner as not in place should not be tested but needs to be recorded as (passing, failing, of N/A) since report is basis for remediation plan.
Response:

Which of the following administrative policy controls requires individuals or organizations to be engaged in good business practices relative to the organization's industry? Response:

Documenting the description of the system in the SSP is the primary responsibility of which RMF role? Response:

Which RMF role needs to be aware of id of new threats, evolving risks, changes in data sensitivity/criticality and changes in operating environment; to make conscious decision on whether system needs to re-certify.
Response: