Risk Assessment and Management Flashcards

During a CGRC risk assessment, an organization's analysts rate a vulnerability's likelihood as 'Low' because a compensating control exists. Later, the assessor discovers the compensating control depends on a shared authentication service that is itself rated 'High' risk and is not in the authorization boundary of the system being assessed. What is the MOST appropriate way to handle the risk determination for the system?

Answer: Reassess likelihood accounting for the inherited dependency, and record the shared service's risk as an input to the system's risk determination, coordinating with the provider's authorizing official

Risk from inherited or external controls must be considered in the system's risk determination. The likelihood rating should reflect the reliability of the dependency, and risk information should be shared and coordinated with the provider's authorizing official (NIST SP 800-37/800-39). Ignoring the dependency understates risk, automatic escalation or boundary expansion is not required, and risk cannot simply be transferred away from the POA&M since accountability for the system's risk remains with its authorizing official.

Under the NIST SP 800-39 multitiered risk management approach, which situation BEST illustrates a failure of communication between Tier 2 (mission/business process) and Tier 3 (information system)?

Answer: A system owner accepts a risk that conflicts with a mission-level dependency because the mission process owner's criticality and risk constraints were never passed to the system level

Tier 2 defines mission/business process criticality, risk-informed architecture, and constraints that must flow down to Tier 3 system-level decisions. When a system-level risk acceptance ignores mission dependencies, the flow of Tier 2 information into Tier 3 failed. The tolerance statement failure is a Tier 1 issue, and the other options describe upward or governance flows operating properly or at other tiers.

An authorizing official is presented with a residual risk that exceeds the organization's stated risk tolerance for a high-impact system, but the mission requires the system to operate. Which action is MOST consistent with the RMF and risk-based decision-making?

Answer: Escalate to the appropriate risk executive or higher authority for a decision, or issue a time-limited ATO with explicit conditions and a tracked plan to bring risk within tolerance

When residual risk exceeds tolerance but the mission need is compelling, the authorizing official should involve the risk executive function or higher authority, or grant a limited, conditional authorization with defined conditions and milestones. A standard-duration ATO ignores the tolerance breach, a blanket denial disregards mission context, and reclassifying impact to manipulate the outcome violates the categorization process.

A system's annualized loss expectancy (ALE) is calculated as $240,000 based on a single loss expectancy of $600,000 and an annual rate of occurrence of 0.4. A proposed control costs $90,000 per year and is expected to reduce the annual rate of occurrence to 0.15, with no change to the single loss expectancy. What is the net annual benefit of the control, and what does it indicate?

Answer: $60,000 net benefit; the control is cost-justified

New ALE = $600,000 × 0.15 = $90,000. Reduction in ALE = $240,000 − $90,000 = $150,000. Net benefit = $150,000 − $90,000 annual control cost = $60,000, so the control is cost-justified. The $150,000 figure is the gross risk reduction before subtracting control cost.

A continuous monitoring program reports that a control previously assessed as effective now shows intermittent failures, and the system owner argues that the overall risk rating should not change until the next scheduled reassessment. According to RMF guidance, what is the BEST response?

Answer: Update the risk assessment now based on ongoing monitoring results, report to the authorizing official, and revise the POA&M and risk response as needed

The Monitor step of the RMF requires that risk be reassessed on an ongoing basis as monitoring data indicates changes in control effectiveness. Findings should be analyzed, the risk response updated, the POA&M revised, and the authorizing official informed. Waiting for a scheduled cycle contradicts ongoing authorization, while automatic revocation is not required without an authorizing official's risk determination.

An organization identifies a risk related to a legacy system that cannot support multifactor authentication. Leadership decides to isolate the system on a segmented network, restrict access to a small set of administrators via a hardened jump host, and increase logging. How should this response be categorized, and what must still be tracked?

Answer: Risk mitigation using compensating controls; residual risk must be documented, accepted by the authorizing official, and monitored

Segmentation, jump host restrictions, and enhanced logging are compensating controls that reduce but do not eliminate the risk, so this is risk mitigation. The remaining residual risk must be documented, formally accepted by the authorizing official, and continuously monitored. Avoidance would require ceasing the activity, transference would require a contractual or insurance shift of liability, and acceptance alone would not involve added controls.