NIST SP 800-30 is best described as?

• A. A risk management guide for information technology systems and addresses risk assessment for federal agencies
• B. A standard for encryption
• C. A contingency planning guide
• D. A password policy document

Answer: (A)

The main concept tested is what NIST SP 800-30 is used for. It is a guide for conducting risk assessments of information technology systems, helping organizations identify, quantify, and prioritize risks so they can make informed risk-management decisions. It provides a structured methodology—characterizing the system, identifying assets, threats, and vulnerabilities, estimating likelihood and impact, determining overall risk, and recommending mitigations and monitoring. This fits into the broader risk-management process used by federal agencies and supports authorization decisions and resource prioritization.

It isn’t a standard for encryption, so it doesn’t specify cryptographic algorithms or how to secure communications. It isn’t a contingency planning guide like SP 800-34, which focuses on business continuity and disaster recovery specifics. It also isn’t a password policy document, which would be covered by other guidelines addressing authentication and identity management.