CGRC Information Security Controls Flashcards

A federal agency categorizes a system as Moderate impact. During control tailoring, the organization determines that a baseline control (PE-3, Physical Access Control) is fully provided by the hosting facility's data center, which has its own ATO and is operated by a different agency. The system owner wants to document this correctly in the SSP. Which approach best aligns with NIST SP 800-53 and SP 800-37 control designation practices?

Answer: Designate PE-3 as a common (inherited) control, document the providing organization, and rely on the provider's assessment evidence and authorization package

Controls that are developed, implemented, and assessed by an organization other than the system owner and can be inherited are common controls. The SSP documents the inheritance, the provider, and references the provider's assessment results and authorization. Scoping does not remove controls merely because someone else implements them; hybrid applies when responsibility is split; compensating controls substitute for a baseline control that cannot be implemented as written.

During continuous monitoring, an assessor finds that a Moderate system's implementation of AC-2(3) (Disable Accounts after a defined inactivity period) works for domain accounts but not for several local service accounts that cannot be disabled without breaking a production interface. Which action is most appropriate under the RMF?

Answer: Document the weakness in the POA&M, identify and evaluate compensating controls (e.g., restricted logon rights, credential vaulting, enhanced logging), and have the AO decide on risk acceptance

A partially implemented control is a weakness that must be tracked in the POA&M. Compensating controls can be proposed and assessed, and the Authorizing Official makes a risk-based decision on continued operation. Marking Satisfied misrepresents the findings, ATO revocation is not automatic, and tailoring changes require rationale and documented approval rather than silent removal.

An organization is selecting controls for a system that processes both a public website and sensitive personnel data. Using FIPS 199 and SP 800-60, the information types yield: public content (C-Low, I-Moderate, A-Low) and personnel records (C-High, I-Moderate, A-Low). What is the correct system security categorization and the resulting baseline?

Answer: High-water mark yields C-High, I-Moderate, A-Low; the overall impact is High, and the High baseline is selected, with any tailoring documented

FIPS 199 and SP 800-60 use the high-water mark for each security objective across information types, giving (High, Moderate, Low). The overall system impact level is the highest of the three, which is High, and under FIPS 200 the High baseline is selected. Averaging is not permitted. Different baselines inside one boundary are not allowed unless the system is decomposed into separate systems or subsystems. Option B is close but omits the documented tailoring step; D states the full correct process.

A cloud-hosted system relies on a FedRAMP-authorized IaaS. The customer's SSP lists SC-13 (Cryptographic Protection) as 'inherited' in full. During assessment, the assessor discovers the customer encrypts application-layer data using its own library with a non-validated cryptographic module before storing it in the IaaS. What is the most accurate finding?

Answer: SC-13 should be designated as hybrid or system-specific, since the customer implements its own cryptographic functionality that must use validated modules and be assessed separately

Inheritance covers only what the provider implements. The customer's own application-layer cryptography is a customer responsibility, so the control is hybrid (or system-specific for that portion) and must use FIPS-validated cryptographic modules under SC-13. Algorithm strength alone does not satisfy validation requirements, and CSP authorization does not extend to customer-built components.

An organization uses OSCAL to express its security documentation. An assessor wants to record that a control objective was tested, that the result was 'not satisfied', and that the finding links to a remediation tracking item. Which pairing of OSCAL models correctly supports this?

Answer: Assessment Results linked to a Plan of Action and Milestones (POA&M)

OSCAL's Assessment Results model captures findings, observations, and objective-level results (satisfied/not-satisfied), and the POA&M model tracks remediation items that findings link to. Catalog/Profile define control content and selection, Component Definition/SSP describe implementation, and Mapping relates control sets to each other rather than recording test results.

A system's significant change (migration from on-premises to a containerized microservices architecture) occurs after an ATO has been granted with a 3-year ongoing authorization. Which action is most consistent with SP 800-37 Rev. 2 guidance?

Answer: Perform a security impact analysis, update the SSP and risk assessment, reassess affected controls, and have the AO determine whether the change requires reauthorization or can be addressed through ongoing authorization

SP 800-37 Rev. 2 requires organizations to analyze the security impact of changes. Affected controls are reassessed and documentation updated, and the AO decides whether the risk posture still falls within acceptable levels or whether reauthorization is needed. Ongoing authorization does not exempt significant changes, and a restart from scratch is unnecessary because existing artifacts can be reused where still valid.