Practice Question – RMF


You are developing the Transportation Management System (TMS) that handles the information types of Ground Transportation and Air Transportation.

  1. Determine the security category of the TMS per FIPS 199 and NIST SP 800-60 in the following format:
    e.g., SC TMS = {(confidentiality, impact), (integrity, impact), (availability, impact)}.
  2. Select baseline security controls according to FISP 200 and NIST SP 800-53 R4. (Scoping)
  3. Tailor the baseline security controls and justify your decisions. (Tailoring)

Jargons: V&V and C&A


What do verification and validation (V&V) and certification and accreditation (C&A) mean? They are indeed jargons, aren’t they?

Take software development project as an example; the software must be verified against solution requirements to confirm if they are implemented correctly, while validated against stakeholder and business requirements to ensure the effectiveness.

Once the software solution is developed, tested, and delivered, it becomes part of the information system as a whole. The information system must be verified to ensure it meets the security requirements. The verification report is the objective evidence for the management to accept the residual risks and authorize it into operation.

The traditional Certification and Accreditation (C&A) process is transformed into the six-step Risk Management Framework (RMF). Please refer to the latest revision of NIST SP 800-37 for details.

Attribute-based access control (ABAC)

Trusted Computing Base

Which of the following provides the most flexible access control?

A. A subject asserting unmarried
B. A subject with the Top Secret clearance
C. A subject with need-to-know
D. A subject assigned to the Admin role

Kindly be reminded that the recommended answer is for your reference only. It doesn’t matter whether you have the right or wrong answer. What really matters is your reasoning process and justifications. 

The recommended answer is A, A subject asserting unmarried.

This question is designed to help you understand the characteristics of the common access control mechanisms as follows:

  • A subject asserting unmarried ⇒ Attribute-based access control (ABAC)
  • A subject with the Top Secret clearance ⇒ Mandatory access control (MAC)
  • A subject with need-to-know ⇒ Discretionary access control (DAC)
  • A subject assigned to the Admin role ⇒ Role-based access control (RBAC)

Access control mechanism comprises 3 parts: authentication, authorization, and accounting. A subject implies a user or principal completes the identification process and its identity has been authenticated.

A subject’s access to objects must be authorized. ABAC, MAC, DAC, and RBAC can enforce the authorization process.

Attribute-based access control (ABAC)

An entity comes with attributes. For example, a user is an entity with attributes, such as Full Name, Marriage Status, Gender, and Aage, to name a few.

Privileges can be granted by attributes. e.g. Access to the Corporate Bonus Mileage Program, a web page, is granted to those members who are female (gender), married (marriage) and come from Taiwan (nationality).

A subject’s attributes, shaping claims or assertions, are dynamic in nature. It’s the most flexible way among the four mechanisms to implement authorization.

Mandatory access control (MAC)

MAC is based on the subject’s security clearance and the object’s classification level, or label. A security clearance is determined through a formal process. Both security clearance and object label are hard to change.

Discretionary access control (DAC)

DAC is based on the Access Control Matrix, a two-dimension matrix of subjects on the row by objects on the column. A row is a subject’s capability; a column is an object’s access control list.

The granularity of DAC is at the entity level (subject or object). ABAC is at the attribute level.

Role-based access control (RBAC)

As the name suggests, RBAS is based on roles. A role is a named collection of predefined permissions and rights; it usually maps to the organizational structure.

A user assigned a role is automatically granted the predefined permissions and rights. It reduces the administrative burden, unlike that of DAC. As the permissions and rights are predefined, or sometimes hard-coded, it’s not convenient to change them.


The concept of flexibility is not rigidly defined in the question, as the question is designed to help you understand the characteristics of the common access control mechanisms. You can evaluate flexibility in terms of granularity of criteria, convenience to change, and administrative or implementation burden.


The CISSP CBK 5th Edition


Under Development…


  • Domain 1
    • The CIA Triad is extended to the Parkerian Hexad
    • Security Governance is highly simplified (almost cut off)
    • Cyber Warfare and Cyberthreat Information Sharing are introduced
    • Headings of topic 1.4 (Understand legal and regulatory issues that pertain to information security in a global context) are not adequately organized
    • Privacy is well explained
    • Policy is well explained
    • Business Continuity is well organized and addressed
    • The explicit official definition of risk from ISC2 is given
    • Risk Management Concepts are highly simplified in Domain 1, while the primary parts are addressed in Domain 8
    • Supply Chain is well addressed
  • Domain 2
    • Data Governance is introduced
    • Data Classification and Data Categorization (based on FIPS 199) are distinguished
    • Asset Classification is addressed
    • Asset Management Lifecycle based on NIST SP 1800-5a is introduced
    • Privacy contents are up-to-date
    • Data Remanence issues are highly simplified
  • Domain 3
    • The engineering process is not covered
    • The engineering architecture is not covered
    • Security engineering principles and ISO/IEC 19249
    • Physical Security is simplified, and CPTED is cut off
  • Domain 4
  • Domain 5
    • Emerging authentication technologies are introduced.
    • Identity Assurance Levels are introduced.
    • Identity lifecycle is mentioned.
    • Provisioning is defined.
  • Domain 6
    • Contents are well organized and addressed.
    • Assessment standards and PenTest approach are addressed.
    • CSA and STAR for security assurance in the cloud are introduced.
    • KPI and KRI are introduced.
    • ISO Standards for audits and audit programs are introduced.
  • Domain 7
    • Need to Know is clarified.
    • Information lifecycle based on ISO 27002
    • Physical Security is highly simplified
  • Domain 8
    • Agile is adequately introduced
    • Application security standards are introduced
    • Microsoft security development lifecycle is introduced
    • Trending topics are introduced, such as Microservices and AI
    • Maturity models are emphasized

Pros and Cons


  • Well-organized
  • Matching the CISSP exam outline to the first level of topics in each domain
  • Trending materials
  • Smaller in size


  • No review questions
  • No appendix for supplement materials or document templates
  • No glossary
  • No references


The Official Risk Definition from ISC2

We finally have the explicit official definition of risk from ISC2.😂 It reads as follows:

“The possibility of damage or harm and the likelihood that damage or harm will be realized.”

But I am not sure if the definition of risk from ISC2 has typos or not, I would revise it as follows:

The possibility of damage or harm and the “magnitude” that damage or harm will be realized.

As a certified professional in ISACA-CRISC and PMI-RMP, I developed my risk management concepts based on the definition from ISO and Dr. David Hillson’s approach, and treat information security as a subdiscipline of risk management.

If you are interested in risk management, please refer to and google the Risk Doctor, Dr. David Hillson for details.


The Clark-Wilson Model

Please refer to