Governance Principles Flashcards

A CGRC practitioner is advising a federal agency whose Authorizing Official (AO) has delegated authorization decisions to a Designated Authorizing Official Representative (DAO Rep). The DAO Rep wants to sign the final authorization decision for a high-impact system to meet a deadline. Under NIST SP 800-37 Rev. 2 governance principles, which statement is correct?

Answer: The DAO Rep may prepare for the decision and advise the AO, but only the AO may sign the authorization decision and accept risk

NIST SP 800-37 Rev. 2 states that the AO role is inherently governmental and that authorization decisions (and the risk acceptance they carry) cannot be delegated. A designated representative may perform preparatory activities such as reviewing the authorization package and advising the AO, but may not make the authorization decision itself. The Risk Executive function informs and provides organization-wide context but does not replace the AO.

An organization's risk executive (function) establishes that a common control provider's inherited control has a significant weakness discovered during a continuous monitoring cycle. Several system owners rely on this control in their security plans. Which governance action best aligns with the tiered risk management approach?

Answer: The common control provider's AO determines the risk and notifies inheriting system owners, whose AOs then reassess the impact on their own authorization decisions

Under NIST SP 800-37 and SP 800-53 common control guidance, the common control provider is responsible for the control's implementation and assessment results, and the weakness must be communicated to inheriting system owners. Each inheriting system's AO remains accountable for the risk to their system and must determine whether the weakness changes their risk posture. Automatic revocation is not mandated, and inherited controls are not removed from the baseline.

During the Prepare step of the RMF, an organization is defining its risk tolerance. Which statement best distinguishes risk tolerance from risk appetite in governance terms?

Answer: Risk appetite is the broad type and amount of risk an organization is willing to pursue, while risk tolerance is the acceptable deviation from that level for specific objectives or risk categories

Risk appetite expresses the high-level amount and type of risk the organization is willing to take to achieve its mission, while risk tolerance operationalizes it as acceptable variation or thresholds for specific objectives or categories. Governance bodies set both, not assessors or individual system owners, and the terms are distinct even though some NIST publications use them loosely.

A system owner proposes to reuse an authorization package from a sister system hosted in the same environment to accelerate approval of a new system. The new system processes a different data type with a higher FIPS 199 impact level. What is the most defensible governance position?

Answer: Reuse of inherited common control assessment evidence may be appropriate, but the new system requires its own categorization, baseline selection, and system-specific assessment and authorization decision

NIST SP 800-37 Rev. 2 encourages reuse of assessment evidence for common and inherited controls, but each system must be categorized per its own information types, select and tailor its own baseline, and receive its own authorization decision. A higher impact level may require additional controls and assessment depth, so a blanket reuse or a memo cannot substitute for system-specific analysis. Total prohibition is also incorrect since reuse is encouraged where valid.

Within an organization's governance structure, which condition most clearly indicates that the separation of duties principle has been violated in the authorization process?

Answer: The security control assessor who assessed the system also serves as the ISSO responsible for implementing and operating its controls

Assessor independence requires that the party evaluating control effectiveness not be responsible for implementing or operating the controls. When the assessor is also the ISSO, they would be assessing their own work, undermining objectivity and the credibility of the assessment results. The other scenarios reflect normal collaboration and consultation within the RMF roles.

An AO issues an authorization to operate with a defined term, but a significant change to the system's architecture occurs mid-term (migration of a data store to a new cloud service model). According to RMF governance principles, what is the most appropriate response?

Answer: The system owner performs a security impact analysis, and the AO determines whether the change is significant enough to require reauthorization or targeted reassessment

Significant changes affecting the risk posture should trigger a security impact analysis, and the AO decides whether reauthorization or targeted assessment is warranted. Under ongoing authorization, the AO's risk determination is based on continuous monitoring information, but changes with material risk impact must be evaluated and communicated to the AO. Neither waiting for the term to end nor unilateral ISSO updates satisfy governance requirements, and the Risk Executive function does not issue authorizations.