Compliance and Policy Flashcards

A CGRC practitioner is assessing a system that processes both federal agency data and data subject to a contractual requirement to follow NIST SP 800-171. The system owner proposes using the 800-171 requirements as the sole control baseline because they are 'more specific.' Which is the most accurate compliance analysis?

Answer: Not acceptable for the federal agency data, because FISMA requires the system to be categorized under FIPS 199 and use SP 800-53 baselines, with 800-171 applying only to the nonfederal contractual context

FISMA-governed federal information systems must be categorized per FIPS 199 and use FIPS 200/SP 800-53 baselines. SP 800-171 is derived from the moderate baseline for protecting CUI on nonfederal systems and is not a superset or a substitute for the federal baseline. Where both obligations exist, the federal requirements apply to the federal data and the contractual obligations are layered on.

During continuous monitoring, an organization discovers that a system's inherited control from a common control provider (CCP) has had its authorization lapse, while the system's own ATO remains valid. What is the most appropriate action by the system's security control assessor and ISSO?

Answer: Treat the inherited controls as not currently supported by an authorization, assess the resulting risk, update the SAR/POA&M as needed, and notify the authorizing official so a risk-based decision can be made

Under the RMF, the system's risk posture depends on inherited controls. A lapse in the provider's authorization changes the risk picture, so the impact must be assessed, documented in the assessment and POA&M artifacts, and communicated to the AO, who makes the risk-based decision (continue, condition, or revoke). Automatic revocation is not mandated, and ignoring the lapse is non-compliant.

An organization is subject to HIPAA and has also adopted the NIST Cybersecurity Framework for governance. A regulator audits and finds that the organization's documented risk analysis was last performed three years ago, though it performs quarterly vulnerability scans. Which statement best describes the compliance gap?

Answer: A gap exists, since the Security Rule requires an accurate and thorough enterprise-wide risk analysis that is updated as environmental or operational changes occur, and scanning alone does not meet that standard

The HIPAA Security Rule risk analysis standard (45 CFR 164.308(a)(1)(ii)(A)) requires an accurate and thorough assessment of potential risks to ePHI, and HHS guidance expects it to be ongoing and updated with changes. Vulnerability scans are only one input. Adopting NIST CSF is not a regulatory safe harbor, and the obligation is not contingent on a reported breach.

A cloud service provider's system holds a FedRAMP Moderate authorization. The provider plans a change that adds a new third-party SaaS subcomponent that will process federal customer data. Under FedRAMP continuous monitoring guidance, how should this change be treated?

Answer: As a significant change requiring notification to the authorizing agency/FedRAMP PMO and an impact analysis, with possible independent assessment of affected controls before deployment

Adding a new external service or component that processes federal data is generally a significant change under FedRAMP continuous monitoring requirements. It calls for a security impact analysis, notification of the agency and FedRAMP, and assessment of affected controls by a 3PAO before or as part of deployment. Commercial certifications do not exempt the change, and full reauthorization is not automatically required.

An organization operating in the EU and the US must comply with both GDPR and a sector-specific US regulation. The two conflict: GDPR requires erasure of a data subject's personal data on valid request, while the US regulation requires retention of the same transaction records for seven years. Which approach best reflects sound compliance practice?

Answer: Apply the GDPR exemption for compliance with a legal obligation, retain only the records legally required, restrict their processing to that purpose, document the legal basis, and inform the data subject of the refusal and reasons

GDPR Article 17(3)(b) provides an exception to erasure where processing is necessary for compliance with a legal obligation. Best practice is to retain only what is legally required, restrict use to that purpose, document the justification, and respond to the data subject with the reason. Neither blanket deletion nor blanket retention is correct, and anonymizing the required records would breach the retention obligation.

A security control assessor finds that a control implementation statement in the SSP claims a control is 'fully implemented,' but testing shows it is operating effectively only for two of the system's five subsystems. The ISSO argues the control is 'effectively implemented overall' because the highest-risk subsystems are covered. What is the correct handling in the assessment results?

Answer: Mark the control as 'other than satisfied' for the uncovered scope, document the finding in the SAR, and require a POA&M item and an SSP correction, leaving risk acceptance to the authorizing official

Assessment determinations must reflect the actual implementation within the defined scope. A partially implemented control is 'other than satisfied,' and the SAR should document the gap. The SSP should be corrected to be accurate, and a POA&M item should track remediation. The decision to accept residual risk belongs to the authorizing official, not the ISSO or the assessor.