CGRC Information Security Controls Flashcards

Which NIST publication provides a catalog of security and privacy controls for federal information systems?

Answer: NIST SP 800-53

NIST SP 800-53 provides the catalog of security and privacy controls used to protect federal information systems.

In the context of CGRC, what is the primary purpose of a security control baseline?

Answer: To provide a starting set of controls for a given impact level

A security control baseline provides a pre-defined set of minimum controls selected based on the system's impact level (Low, Moderate, or High).

Which control family in NIST SP 800-53 addresses identification and authentication requirements?

Answer: IA – Identification and Authentication

The IA (Identification and Authentication) control family addresses requirements for uniquely identifying and authenticating users and devices.

What term describes the process of selecting and adjusting security controls to meet the specific needs of an organization or system?

Answer: Control tailoring

Tailoring is the process of modifying a baseline by adding, removing, or adjusting controls to fit the system's specific environment and risk profile.

Which type of control is implemented through hardware, software, or firmware to protect information systems?

Answer: Technical control

Technical controls (also called logical controls) use technology such as encryption, firewalls, and access control software to protect systems.

Under NIST SP 800-53, which control family specifically addresses planning for security activities within a system?

Answer: PL – Planning

The PL (Planning) control family covers system security plans and related planning activities required for FISMA compliance.