CGRC Information Security Controls Flashcards

Which control family in NIST SP 800-53 covers contingency planning, including backup and recovery procedures?

Answer: CP – Contingency Planning

The CP (Contingency Planning) family includes controls for developing, testing, and maintaining plans to restore system operations after a disruption.

What does the principle of least privilege mean in the context of access control?

Answer: Users are granted only the minimum access required to perform their job functions

Least privilege limits users and processes to only the access rights strictly necessary for their authorized tasks, reducing the risk of unauthorized actions.

Which type of security assessment involves actively probing a system to identify exploitable vulnerabilities?

Answer: Penetration testing

Penetration testing simulates real-world attacks to discover exploitable weaknesses that automated scans or reviews might miss.

Under NIST SP 800-53, which control ensures that audit logs are protected from unauthorized modification or deletion?

Answer: AU-9 – Protection of Audit Information

AU-9 protects audit information and audit tools from unauthorized access, modification, and deletion to preserve log integrity.

What is the purpose of the SC (System and Communications Protection) control family?

Answer: Protecting system boundaries and communications from unauthorized access or disclosure

SC controls address boundary protection, network segmentation, encryption of data in transit, and other safeguards for system communications.

Which term describes the documented approval to operate a system based on an accepted level of residual risk?

Answer: Authorization to Operate (ATO)

An ATO is the formal decision by an Authorizing Official that the residual risk to the organization is acceptable and the system may operate.