Risks with low ratings of probability and impact are included on a ____ for future monitoring.
Response:

Which one of the following is the only output for the qualitative risk analysis process? Response:

Certification and Accreditation (C&A or CnA) is a process for implementing information security.
Which of the following is the correct order of C&A phases in a DITSCAP assessment? Response:

According to NIST SP 800-37 Rev 2 appendix F, there are several types of authorizations including all of the following, except one.
Response:

Which role has the supporting responsibility to coordinate changes to the system, assess the security impact and update the system security plan?
Response: