CAP Security Control Selection, Tailoring & Baselines (NIST SP 800-53)

Question 1

A federal system is categorized as MODERATE impact. Which NIST SP 800-53 security control baseline should be applied as the starting point?

Accepted Answer

The MODERATE baseline.

Answer

NIST SP 800-53 defines three control baselines (LOW, MODERATE, HIGH) aligned to FIPS 199 impact levels. A MODERATE-categorized system uses the MODERATE baseline as its starting point before any tailoring.

Question 2

Which tailoring action allows an organization to remove a security control from the baseline because it is not applicable to the system's operating environment?

Accepted Answer

Scoping

Answer

Scoping involves applying specific guidance to adjust the baseline — including eliminating controls that are not applicable (e.g., removing mobile device controls from a system that has no mobile interfaces). Supplementation adds controls; overlays are community-wide tailoring guidance; compensating controls substitute when a baseline control cannot be implemented.

Question 3

An organization cannot implement a required NIST SP 800-53 control due to a documented technical constraint. What is the correct approach?

Accepted Answer

Implement a compensating control that provides equivalent protection, and document it.

Answer

When a required control cannot be implemented, organizations should identify and implement a compensating control that provides equivalent or comparable protection. This must be documented in the Security Plan and approved by the Authorizing Official.

Question 4

Which of the following best describes a 'security control overlay' in NIST SP 800-53?

Accepted Answer

A community-wide tailoring of the security control catalog for a specific technology type, environment, or mission.

Answer

Overlays are tailored baselines developed for specific communities of interest (e.g., cloud systems, healthcare, Industrial Control Systems). They adjust the baseline controls to reflect the unique requirements of that environment and are approved for community-wide use.

Question 5

In NIST SP 800-53, security controls are organized into 'families.' Which control family specifically addresses planning for security activities?

Accepted Answer

Planning (PL)

Answer

The Planning (PL) family in NIST SP 800-53 includes controls related to security planning activities, such as developing the System Security Plan (SSP) and Rules of Behavior. The PL family is directly relevant to the authorization documentation process.

(CAP) Certified Authorization Professional Practice Test

(CAP) Certified Authorization Professional Practice Test

CAP Security Control Selection, Tailoring & Baselines (NIST SP 800-53)