Control Selection 7 Flashcards

During control selection for a federal information system, the security categorization results in a MODERATE impact level. However, the system processes data subject to a specific regulatory overlay (e.g., IRS Publication 1075) that mandates several HIGH baseline controls. Which statement BEST describes how the authorizing official should proceed?

Answer: Apply the MODERATE baseline first, then incorporate the overlay's additional or enhanced controls, documenting the rationale in the System Security Plan.

NIST SP 800-53 and the RMF process allow overlays to supplement, modify, or extend the applicable baseline without changing the formal security categorization. The correct approach is to start with the MODERATE baseline and then apply the overlay's tailoring guidance on top of it, documenting all additions and the regulatory justification in the SSP. Re-categorizing the entire system would be incorrect because categorization is based on the system's information types and potential impact, not on regulatory overlays. Overlays are not compensating controls; they are formally recognized tailoring mechanisms.

An organization identifies a control from NIST SP 800-53 Rev 5 as a 'common control' provided by the enterprise IT department. During authorization of a subordinate system, the system owner discovers that the common control implementation has a known deficiency documented in the provider's Plan of Action and Milestones. What is the system owner's PRIMARY responsibility in this situation?

Answer: Accept the inherited control, assess the residual risk introduced by the deficiency, and determine if additional compensating or supplemental controls are needed at the system level.

When inheriting a common control with a known deficiency, the system owner must still accept the inheritance (it would be impractical to duplicate all common controls), but they retain accountability for residual risk. NIST RMF guidance requires the system owner to assess the impact of the deficiency on their specific system, document it in the SSP, and determine whether compensating or supplemental controls are needed. Delaying authorization is not required, and unilaterally duplicating the control is not the standard response.

A cloud-based system is jointly operated by a federal agency and a commercial cloud service provider (CSP). The CSP holds a FedRAMP authorization at the MODERATE level. The agency's specific workload on that CSP has been categorized as HIGH. Which approach to control selection is MOST appropriate for the agency's system-level authorization?

Answer: Inherit applicable controls from the CSP's FedRAMP package where they satisfy HIGH baseline requirements; implement or augment remaining controls at the agency or application layer to close any gaps.

In a shared-responsibility cloud model, the agency inherits controls from the CSP's FedRAMP authorization where those controls meet or can be accepted toward the HIGH baseline. However, the FedRAMP MODERATE package will not satisfy all HIGH baseline requirements. The agency must identify gaps and implement supplemental controls at the agency, application, or data layer. Option D is tempting but is incorrect because inherited controls must still be reviewed for adequacy against the HIGH baseline — they cannot be accepted blindly without a gap analysis.

During the tailoring step of control selection, a system owner wants to apply a scoping consideration to remove a specific control, arguing that it is 'not applicable' because the system has no external network connections. The security assessor notes that the control in question covers insider threat scenarios, not only external network threats. Under NIST SP 800-53A guidance, which outcome is MOST defensible?

Answer: The control should be retained or the scoping rationale must be revised, because the threat environment (insider threat) is not eliminated by the absence of external network connections.

Scoping considerations under NIST SP 800-53 allow controls to be excluded only when a documented and defensible rationale exists — such as when a specific threat or technology is genuinely absent. If the control addresses insider threats, the lack of external connectivity does not eliminate the threat vector. The tailoring rationale must be technically sound and defensible during assessment. Simply documenting a decision that contradicts the threat model is insufficient. The assessor's role includes flagging technically flawed scoping rationale, not just accepting it.

An organization is selecting controls for a system that processes both Controlled Unclassified Information (CUI) and personally identifiable information (PII). The privacy impact assessment identifies a HIGH privacy risk for one data flow. Under NIST SP 800-53 Rev 5, which statement MOST accurately describes the relationship between security and privacy control selection for this system?

Answer: Privacy controls from the PT family and relevant crosscutting controls must be selected alongside security controls, with the privacy risk informing tailoring decisions — the two frameworks are integrated, not separate.

NIST SP 800-53 Rev 5 unified security and privacy into a single control catalog. Privacy controls (PT family) are not optional for federal systems processing PII — they are mandatory requirements. Furthermore, many privacy risks are addressed through crosscutting controls shared between security and privacy disciplines. A HIGH privacy risk from the PIA informs tailoring (e.g., applying stronger data minimization, consent, and access controls) but does not automatically trigger a FIPS 199 re-categorization, which governs confidentiality/integrity/availability of information, not privacy risk levels specifically.

A system owner proposes a compensating control to substitute for a required MODERATE baseline control that cannot be fully implemented due to a legacy technology constraint. Under NIST RMF guidance, which condition is MOST critical for the authorizing official to verify before accepting the compensating control?

Answer: The compensating control provides equivalent or greater protection against the same threats and vulnerabilities that the original control was designed to address, and the residual risk is acceptable.

The core test for a compensating control under NIST guidance is functional equivalence: the compensating control must address the same threat vectors and vulnerabilities as the original control and provide a comparable level of protection. It does not need to come from the same control family, and a POAM entry alone does not validate the control's adequacy — a POAM documents the deficiency, not the compensating measure's effectiveness. An EOL waiver from the CIO addresses the technology lifecycle but does not itself authorize or validate compensating controls. The authorizing official must be satisfied that residual risk is explicitly assessed and accepted.