1. The NIST Risk Management Framework uses the security category (SC) (see chapter 1, sections 1.1.2 and 1.2) as part of the selection of security controls to reflect the impact of cybersecurity failures of an assets CIA properties on the organization or individual.

a) Using the NIST Risk Management Framework (RMF), Determine and briefly explain the security category of two information technology devices you use b) Finally, compute the relative significance (see section 1.4) of one risk for each device studied above using numerically measurable information. Choose risks you argue are the most relevant to your ability to continue your life and work.

2. Choose a real organization (for example hospital, military organization, bank, online business) you are familiar with or interested in, and perform an assessment of the following

a) Briefly explain how to apply the principle of least privilege to the members of this organization to maximize the information security of this business b) Briefly explain how to apply the principle of defense in depth to protect the assets you argue this organization has