CGRC Information Security Controls Flashcards

An organization authorizes a system whose SCA found that a compensating control meets the intent of a baseline control that cannot be implemented on a legacy OT component. Which RMF-aligned action best ensures the AO can make a risk-based decision about this deviation?

Answer: Document the tailoring rationale and compensating control in the SSP, assess its effectiveness in the SAR, and present the residual risk to the AO in the authorization package

Tailoring (including compensating controls) must be documented with rationale in the SSP, assessed for effectiveness by the assessor in the SAR, and the resulting residual risk presented to the AO in the authorization package. Categorization does not remove controls, and omitting the information undermines informed risk acceptance.

A common control provider's inherited control is assessed as 'Other Than Satisfied' after a system owner has already received an ATO that relies on that control. What is the most appropriate immediate action?

Answer: Notify the system owner and AO, reassess the risk to the dependent system, and update the SSP and POA&M as the AO determines whether authorization remains acceptable

Inherited control deficiencies affect all dependent systems. Dependent system owners and AOs must be informed, the risk reassessed, documentation updated, and the AO decides whether to continue, condition, or withdraw authorization. Nothing is automatic, and ignoring or reclassifying the issue undermines the common control relationship.

During continuous monitoring, a system owner proposes replacing a perimeter firewall with a different vendor's product that provides the same security functions. Which step is MOST appropriate within the security impact analysis process?

Answer: Analyze whether the change affects control implementation, and test the affected controls to verify they remain effective before and after deployment, updating the SSP and POA&M as needed

Under the monitor step, changes are analyzed for security impact, and affected controls are assessed for continued effectiveness. Documentation is updated accordingly. Whether reauthorization is needed depends on the significance of the change, not on every change automatically.

Which scenario BEST illustrates a hybrid control under NIST SP 800-53 and RMF guidance?

Answer: An incident response control where the organization provides the common plan and training, while the system owner implements system-specific reporting procedures

A hybrid control has part of its implementation inherited as a common control and part implemented as system-specific. The incident response example splits responsibility between organization-level and system-level elements.

An assessor finds that a control is implemented correctly and operating as intended, but it does not meet the security requirement because the control's design does not address the threat it was selected to mitigate. How should the assessor characterize this finding?

Answer: The control is Other Than Satisfied because the implementation fails to meet the intended security objective, indicating a weakness in design or selection

Assessment determines whether a control is implemented correctly, operating as intended, and producing the desired outcome in meeting the security requirements. A control that works as built but does not address its objective is Other Than Satisfied, and the issue should be addressed through the POA&M or tailoring decisions, not simply removed.

A system's POA&M contains a high-risk weakness whose scheduled completion date has slipped twice. Which action is MOST consistent with sound risk governance?

Answer: Document the reason for each delay, revise milestones and resources, and report the status to the AO, who may accept the risk, require remediation, or reconsider authorization

POA&M changes, including slipped milestones, must be documented with rationale and communicated to the AO, who retains authority over risk acceptance and authorization decisions. Informal closure or silent date changes erode accountability and defeat the purpose of the POA&M.