CGRC Information Security Controls Flashcards

A federal agency is authorizing a system whose inherited common controls come from a shared services provider. The provider's most recent assessment is 14 months old, and the system owner wants to rely on it without reassessment. Under the RMF, what is the MOST appropriate action by the authorizing official's team?

Answer: Review the provider's current assessment evidence and continuous monitoring status, and determine whether the inherited control assessment results remain valid for this authorization decision

Inherited (common) controls remain subject to ongoing authorization and monitoring by the provider. The system's AO must consider the currency and validity of the provider's assessment evidence and monitoring results, not blindly accept stale results or duplicate the effort. Inherited control assessment results are reused when current and adequate.

During control selection, an organization tailors a moderate-impact baseline and decides a specified control cannot be implemented because of a legacy operational technology constraint. Which approach BEST aligns with RMF tailoring guidance?

Answer: Implement a compensating control, document the rationale, and obtain risk acceptance by the appropriate authority as part of the security plan

Tailoring permits compensating controls when a baseline control cannot be implemented. The rationale and the resulting residual risk must be documented in the security plan and accepted by the authorizing official. A POA&M tracks weaknesses to be remediated, not permanent control removals.

An assessor tests a configuration management control using only a review of the organization's change management policy and interviews with the change board chair. What is the PRIMARY limitation of this assessment approach?

Answer: The approach provides limited assurance because it does not include examination of actual system configurations or testing of the control's operation

Assessment methods are examine, interview, and test. Relying only on documentation and interviews gives lower assurance on whether the control is actually implemented and operating as intended. Testing and examination of actual configurations and artifacts provide greater depth and coverage.

A system's POA&M contains a high-severity weakness whose remediation date has slipped twice. The AO previously issued an ATO with conditions. What is the MOST appropriate governance response?

Answer: Escalate to the AO for re-evaluation of the risk and the authorization decision, since conditions of the ATO are not being met

Repeated slippage of a high-severity item that falls under ATO conditions changes the residual risk picture. The AO must be informed so they can reassess risk and decide whether to continue, modify, or revoke the authorization. Closing and reopening items to reset dates undermines integrity of the POA&M.

An organization applies the continuous monitoring strategy to a control whose effectiveness depends on infrequently changing hardware. A newly published vulnerability affects that hardware family. How should the monitoring frequency for this control be handled?

Answer: Increase monitoring frequency or perform an event-driven assessment, since the threat environment changed and affects the risk to the control

Continuous monitoring frequency should reflect control volatility, impact, and the changing threat and vulnerability landscape. New vulnerabilities affecting the control's underlying components justify an event-driven or more frequent assessment, with the strategy updated accordingly.

A system security plan states that a boundary protection control is fully implemented, but an assessor finds that an undocumented administrative interface bypasses the firewall. Which assessment finding and consequence is MOST accurate?

Answer: The control is 'other than satisfied' because the implementation does not meet the control objective across the authorization boundary, and the finding should be documented with risk analysis

Control assessment evaluates whether the control meets its objective as implemented across the whole authorization boundary. An undocumented bypass means the objective is not met, so the control is other than satisfied. The finding goes in the assessment report with a risk analysis, and the SSP and boundary documentation need correction.