Control Selection 5 Flashcards

An organization operating a moderate-impact system discovers that a required baseline control is technically infeasible due to a legacy hardware constraint. According to NIST SP 800-37, what is the MOST appropriate course of action?

Answer: Document the infeasibility and implement a compensating control with equivalent protection

When a baseline control is technically infeasible, organizations should document the rationale and implement compensating controls that provide equivalent or comparable protection. This satisfies the intent of the control while acknowledging real-world constraints. Simply removing a control without alternatives or requesting a blanket waiver does not maintain the required security posture.

During control selection for a cloud-hosted federal system, the system owner identifies several controls already implemented by the cloud service provider (CSP). How should these controls be classified in the system security plan?

Answer: Inherited controls, because they are provided and managed by the CSP as a common control provider

Controls implemented and managed by the cloud service provider on behalf of tenant systems are classified as inherited (common) controls. The CSP acts as the common control provider, and the system owner inherits the protection those controls provide. This distinction is essential for accurate control responsibility mapping in the SSP.

A risk assessment reveals that a HIGH-impact system's selected control baseline does not adequately address an emerging threat specific to the organization's mission environment. What tailoring action should the security engineer take?

Answer: Augment the baseline by adding supplemental controls to address the identified threat

When a baseline does not sufficiently address identified threats, organizations should augment it by selecting additional controls or control enhancements. This is a standard tailoring action defined in NIST SP 800-53B. Downgrading the baseline or deferring without action would increase residual risk beyond acceptable levels for a HIGH-impact system.

Which NIST publication provides the catalog from which security and privacy controls are selected during the Control Selection step of the RMF?

Answer: NIST SP 800-53 — Security and Privacy Controls for Information Systems

NIST SP 800-53 is the control catalog used during RMF Step 2 (Select). It provides the full set of security and privacy controls and enhancements from which organizations select and tailor controls for their systems. SP 800-37 governs the overall RMF process, SP 800-30 supports risk assessments, and SP 800-60 guides security categorization.

An organization is selecting controls for a system that processes both Controlled Unclassified Information (CUI) and publicly available data. The security categorization resulted in a MODERATE overall impact level. Which baseline should serve as the STARTING point for control selection?

Answer: MODERATE baseline, tailored based on the specific characteristics of the system

The MODERATE impact level determined through security categorization maps directly to the MODERATE control baseline as the starting point. Tailoring then adjusts controls based on system-specific factors such as environment, threat, and mission needs. Using a LOW baseline ignores the CUI requirements, and escalating to HIGH without justification would be excessive and unsupported.

When applying scoping considerations during control tailoring, which of the following represents a VALID reason to exclude a baseline control from a system?

Answer: The control addresses a technology type not present in the system (e.g., wireless controls for a wired-only system)

Technology applicability is a recognized scoping consideration in NIST SP 800-53B. If a control is designed for a technology or capability not used in the system (such as wireless security controls for a fully wired system), it may be scoped out with proper documentation. Cost and personal preference are not valid scoping justifications, and pending AO review does not automatically exclude a control.