What are the steps within the risk management frame work, explain each step and give an example of how they apply to a system such as a firewall, server, or computer?

What is a system security risk management approach?

Give a specific example as it applies to a technology system, such as a firewall. What does it mean to implement controls based on the system and not an enterprise base risk management approach? Give specific examples?

What is fisma? Who does it apply to?

What is fips? Who does it apply to?