Control Selection 8 Flashcards

An organization operating a moderate-impact system discovers that a required baseline control has an inherited implementation from a common control provider, but the provider's assessment results are over 18 months old. The system owner wants to accept the inheritance as-is to avoid re-assessment costs. What is the MOST appropriate action under NIST RMF guidance?

Answer: Determine whether the inherited control still satisfies the system's security requirements and document the rationale; if assessment results are stale beyond organizational policy, request updated evidence or apply compensating controls

NIST SP 800-37 Rev. 2 requires system owners to verify that inherited controls continue to satisfy the system's security requirements. When assessment evidence is stale beyond organizational policy thresholds, the system owner must either obtain updated evidence from the provider, supplement with compensating controls, or formally document residual risk — not simply accept stale results by default. Blanket acceptance ignores the system owner's ongoing responsibility for inherited control adequacy.

During control tailoring for a HIGH-impact system, a security engineer proposes removing SC-8 (Transmission Confidentiality and Integrity) from the baseline, citing that all data flows are internal to an air-gapped enclave. The ISSO approves the tailoring and documents the rationale. Which CGRC concept most directly challenges the validity of this tailoring decision?

Answer: The air-gap assumption does not eliminate the insider-threat vector for data in transit across internal segments, meaning the technical rationale may be insufficient to justify removal

While air-gapped enclaves reduce external threat vectors, SC-8 addresses transmission integrity and confidentiality across all network segments, including internal ones. An air gap does not eliminate insider threats, rogue internal devices, or cross-segment lateral movement. The technical rationale that 'all flows are internal' does not by itself justify removing SC-8 from a HIGH-impact baseline, because the control's purpose extends beyond external boundary protection. Scoping guidance requires that removed controls have no applicable threat vectors — a claim that is difficult to sustain on a HIGH system.

A federal agency is selecting controls for a system that processes CUI but is not yet formally categorized under FIPS 199. The program manager instructs the security team to begin with the MODERATE baseline to 'get started.' Under NIST RMF, what is the most significant problem with this approach?

Answer: Control selection must follow a completed FIPS 199 categorization and FIPS 200 minimum-security determination; applying a baseline prior to categorization means controls may be misaligned with actual system impact levels

NIST RMF Step 2 (Categorize) must be completed before Step 3 (Select Controls). The FIPS 199 categorization drives the impact level, which in turn determines the appropriate NIST SP 800-53 baseline under FIPS 200. Starting with a MODERATE baseline before categorization risks selecting an incorrect baseline — the system could warrant HIGH controls, or scoping decisions may be made on false assumptions. Preliminary selection is not sanctioned by RMF as a substitute for the formal categorization step.

An organization's continuous monitoring strategy calls for annual reassessment of all HIGH-baseline controls. A newly onboarded ISSO argues that compensating controls implemented to address a known weakness should be reassessed on the same annual cycle as baseline controls. The senior ISSO disagrees. Who is most likely correct, and why?

Answer: The senior ISSO is likely correct; compensating controls address specific known weaknesses and typically warrant more frequent monitoring and reassessment than standard baseline controls, since their adequacy is directly tied to an active risk acceptance

Compensating controls are implemented specifically because a required control cannot be fully satisfied — meaning they are directly linked to an ongoing residual risk acceptance. NIST guidance and sound ISCM practice call for compensating controls to be monitored more frequently than standard controls, because their adequacy must be continuously validated against the weakness they are compensating for. An annual cycle aligned with baseline controls would be insufficient for controls that exist to patch a known gap in the security posture.

A cloud service provider (CSP) offers a FedRAMP-authorized SaaS offering at MODERATE impact. A federal agency wants to deploy a HIGH-impact workload on this SaaS platform, leveraging the existing FedRAMP authorization via inheritance. Which statement BEST describes the control selection challenge in this scenario?

Answer: The agency may inherit MODERATE-level controls from the CSP's authorization, but must identify and implement additional controls — or agency-specific control enhancements — to satisfy the HIGH baseline requirements not covered by the inherited MODERATE authorization

A FedRAMP MODERATE authorization covers controls scoped to MODERATE impact. When an agency system is categorized at HIGH, the HIGH baseline includes additional and enhanced controls beyond those in the MODERATE baseline. The agency must conduct a gap analysis: inherited MODERATE controls satisfy what they cover, but the delta between MODERATE and HIGH baselines — plus any agency-specific requirements — must be addressed through agency-implemented controls, control enhancements, or compensating measures. FedRAMP P-ATO does not auto-elevate to HIGH.

During a CGRC audit review, an assessor finds that a system's System Security Plan lists AU-6 (Audit Record Review, Analysis, and Reporting) as 'not applicable' because the system generates no audit logs. The system owner justified this by citing the 'not applicable' scoping option. What is the MOST critical flaw in this reasoning?

Answer: Marking AU-6 not applicable because no logs are generated is circular reasoning — AU-2 and AU-3 likely require the system to generate logs in the first place, making the absence of logs itself a control deficiency rather than a valid basis for scoping out AU-6

AU-6 governs the review and analysis of audit records. The premise for marking it 'not applicable' — that no logs exist — creates a circular and self-defeating argument: the absence of logs is itself a potential deficiency under AU-2 (Event Logging) and AU-3 (Content of Audit Records), which require systems to generate defined audit events. Using the lack of logs (a potential non-compliance) to justify removing the downstream review control (AU-6) masks the underlying gap rather than addressing it. Scoping guidance does not permit removing controls based on the system's own failure to satisfy upstream controls.