Control Selection 10 Flashcards

An organization is implementing a hybrid cloud environment and must select controls from NIST SP 800-53. The system is classified as MODERATE impact, but one specific subsystem processes data that independently meets HIGH confidentiality requirements. Which control selection approach is most appropriate according to RMF guidance?

Answer: Apply MODERATE baseline controls system-wide and selectively overlay HIGH confidentiality controls only on the subsystem with elevated requirements

NIST SP 800-53 and RMF guidance support the use of control overlays to address specific protection needs within a system without elevating the entire system's baseline. Applying MODERATE controls system-wide with targeted HIGH confidentiality controls on the sensitive subsystem is the most precise and efficient approach. Elevating the entire system to HIGH is overly burdensome; decomposing boundaries may be appropriate in some cases but is not required when overlays suffice; uniform MODERATE leaves the sensitive subsystem under-protected.

During control selection, a security engineer proposes compensating controls for a legacy system that cannot implement multi-factor authentication (IA-2(1)). Management approves the compensating controls without documenting the specific technical or operational constraints that prevent MFA implementation. What is the PRIMARY risk of this gap in the SSP?

Answer: Authorizing officials cannot make a fully informed risk acceptance decision, and future assessors lack the rationale to evaluate compensating control adequacy

Compensating controls are permissible under NIST RMF, but the SSP must document the specific constraints (technical, operational, or mission) that prevent implementing the original control, the risk accepted, and how the compensating controls provide equivalent protection. Without this documentation, the AO cannot make an informed authorization decision and future assessors cannot evaluate whether the compensating controls remain adequate. NIST does not prohibit compensating controls for identity controls, does not require annual re-selection, and does not mandate CISA pre-approval.

A CGRC practitioner is conducting a control tailoring analysis for a DoD system operating in a disconnected, intermittent, and limited (DIL) environment. The practitioner recommends scoping out SI-3 (Malicious Code Protection) because real-time signature updates are operationally infeasible. Which RMF principle most directly supports OR refutes this tailoring decision?

Answer: Scoping guidance allows removal of controls based on operational factors, but the residual risk must be explicitly accepted and alternative measures documented in the SSP

NIST SP 800-53B scoping guidance permits tailoring controls based on operational or environmental factors, including technology applicability and mission constraints. However, scoping out a control does not eliminate the underlying risk — it must be explicitly accepted by the AO, and any alternative or compensating measures must be documented. The practitioner cannot simply remove SI-3 without documenting residual risk and obtaining authorization. DIL environments do not constitute blanket exemptions from NIST 800-53, and SI-3 may or may not be a common control depending on the specific system architecture.

An organization selects control PE-3 (Physical Access Control) as a system-specific control and documents it in the SSP. A subsequent review reveals that three other systems in the same facility inherit PE-3 from a facility-level common control provider. The original system's SSP lists PE-3 as system-specific rather than hybrid or inherited. What is the most significant consequence of this misclassification?

Answer: Duplicate assessment effort may be expended, inherited responsibility boundaries are obscured, and the common control provider's accountability is undermined in the authorization package

Misclassifying an inherited or hybrid control as system-specific creates several practical problems: it may cause redundant assessment work (assessing the control at the system level when it's already assessed at the common control level), obscures the actual accountability chain (the common control provider's responsibility disappears from the package), and can mislead the AO about who is responsible for control implementation. It does not automatically revoke an ATO, does not trigger re-categorization, and does not generate a mandatory POA&M entry — though it should be corrected in the SSP.

NIST SP 800-53B defines three control baselines. An organization is selecting controls for a Privacy Overlay application where the system processes PII for 50,000 individuals but poses LOW availability impact and MODERATE confidentiality and integrity impact. The Privacy Overlay adds controls beyond the MODERATE baseline. At what point in the RMF process does the organization formally integrate Privacy Overlay controls into the control baseline?

Answer: During Step 2 (Select), after establishing the initial baseline and then applying overlays, tailoring guidance, and organizational parameters to produce the final control set

Control selection — including the application of overlays such as the Privacy Overlay — occurs in RMF Step 2 (Select). The process is: establish the initial baseline based on system categorization → apply overlays → tailor controls → document organization-defined parameter values → produce the final tailored control set documented in the SSP. Step 1 identifies that PII is present, but the formal integration of overlay controls into the baseline happens in Step 2. Controls are not added during assessment (Step 4) or monitoring (Step 6) — those steps evaluate and maintain controls already selected.

A risk executive reviewing a system's SSP notices that the program team selected AC-2(7) (Privileged User Accounts — Role-Based Schemes) as an enhancement but did not select the base control AC-2 (Account Management). The team argues that AC-2(7) inherently satisfies account management requirements. How should the CGRC practitioner advise?

Answer: AC-2 must be selected and implemented because control enhancements are additive supplements to base controls, not replacements; omitting the base creates an unassessed gap in account management

Under NIST SP 800-53 architecture, control enhancements are explicitly additive — they provide additional functionality or stringency ON TOP of the base control, not as substitutes for it. AC-2(7) addresses role-based privileged account schemes but presupposes that base account management (AC-2) is already in place. Selecting an enhancement without the base control leaves core account management requirements unaddressed and unassessed. NIST does not permit enhancement-only selection as a substitute for base controls; a POA&M alone does not authorize omitting a required control.