Compliance Programs Flashcards

An organization is pursuing authorization of a system that processes both federal contract information and a small volume of CUI. The compliance program manager discovers that a control inherited from a FedRAMP-authorized cloud provider has a Plan of Action and Milestones (POA&M) item open on the provider's side. What is the MOST appropriate action for the system's compliance program?

Answer: Document the inherited control with its known deficiency, assess the residual risk to the system, and track the provider's POA&M item as a dependency in the system's own risk register

Inherited controls do not transfer accountability. The system owner must understand the provider's known weaknesses, evaluate how they affect the system's own risk posture, and track the dependency. A FedRAMP authorization does not mean every control is flawless, and removing the provider from the boundary or imposing a blanket closure requirement ignores risk-based decision making.

During a continuous monitoring review, a compliance program discovers that a significant change to a data flow was implemented through an emergency change process and bypassed the standard security impact analysis. Which response BEST aligns with a mature compliance program?

Answer: Perform a retroactive security impact analysis, update the system security plan and risk assessment as needed, notify the authorizing official if the risk posture changed, and review the emergency process for gaps

Emergency changes may expedite approvals but still require post-implementation analysis. A mature program performs a retroactive impact analysis, updates authorization artifacts, informs the authorizing official when risk has materially changed, and addresses the process weakness that allowed the bypass.

A program office must demonstrate compliance with two overlapping regulatory frameworks that specify different required frequencies for access reviews (quarterly under one, semi-annually under the other). Which approach is MOST defensible?

Answer: Implement the more stringent frequency across the control set and map the single evidence stream to both frameworks' requirements

Harmonizing to the most stringent applicable requirement satisfies both obligations with one control activity and one body of evidence. Choosing the weaker cycle would fail the stricter framework, and separate cycles create redundant work and inconsistent evidence.

An internal audit finds that a control was operating effectively during testing, but the supporting evidence was generated manually and cannot be independently reproduced. From a compliance program perspective, what is the PRIMARY concern?

Answer: The evidence lacks reliability and repeatability, which weakens assurance and may undermine assessors' ability to validate control effectiveness over time

Control operation and evidence quality are distinct issues. Evidence that cannot be reproduced or independently verified reduces assurance and makes continuous monitoring unreliable, even though the control may be working. Manual evidence is not prohibited, and replacement must be justified by risk and cost.

A system owner proposes accepting a high-severity residual risk on a system by having the information system security officer (ISSO) sign the risk acceptance, citing project deadlines. According to proper governance in a compliance program, what is the main problem with this proposal?

Answer: The ISSO lacks the delegated authority to accept risk on behalf of the organization; that decision belongs to the authorizing official or designated risk executive

Risk acceptance is an authority-bound decision reserved for the authorizing official (or delegated risk executive function). The ISSO advises and manages security operations but does not hold the authority to accept organizational risk. High risks can be accepted when properly authorized, and business factors may inform the decision.

A newly identified third-party subservice organization supports a key control within a vendor that your organization relies on, but the vendor's SOC 2 report uses the carve-out method for that subservice. What should the compliance program do to address the gap?

Answer: Request the subservice organization's own assurance report, evaluate complementary subservice organization controls, and perform additional due diligence or monitoring where coverage is lacking

The carve-out method excludes the subservice organization's controls from the vendor's report, so the user entity must obtain separate assurance and assess complementary subservice organization controls. Contract clauses and assumptions do not provide control assurance, and termination is disproportionate.