Mixed Deck — All CGRC Topics Flashcards

Under FIPS 199, how should the potential impact be rated when a loss of integrity is expected to have a limited adverse effect on organizational operations but a serious adverse effect on individuals?

Answer: High, because any serious adverse effect on individuals automatically means High

FIPS 199 defines High as a severe or catastrophic adverse effect, Moderate as serious, and Low as limited. The potential impact value is determined by the worst effect across organizational operations, organizational assets, individuals, other organizations, or the Nation. Here the effect on individuals is described as serious, which is Moderate, so option 3 as written is mistaken; the correct reading is that the rating is the highest of the effects, which is Moderate.

During control selection, an organization tailors a moderate-impact baseline and decides a specified control cannot be implemented because of a legacy operational technology constraint. Which approach BEST aligns with RMF tailoring guidance?

Answer: Implement a compensating control, document the rationale, and obtain risk acceptance by the appropriate authority as part of the security plan

Tailoring permits compensating controls when a baseline control cannot be implemented. The rationale and the resulting residual risk must be documented in the security plan and accepted by the authorizing official. A POA&M tracks weaknesses to be remediated, not permanent control removals.

An organization is defining monitoring frequency for a set of controls. Which factor should NOT be the primary driver when determining that frequency under NIST SP 800-137 guidance?

Answer: The preferred reporting schedule of the vendor whose tool performs the check

SP 800-137 states that frequencies should be driven by control volatility, system categorization/impact, control criticality, threat and vulnerability information, risk assessment results, and reporting requirements of the organization. A vendor tool's default reporting cadence is an implementation detail and should not determine how often an organization needs assurance about a control.

An organization's contract with a managed security provider includes a large indemnification clause and requires the provider to carry cyber liability insurance. Leadership says this 'transfers' the risk of a breach caused by the provider. Which response BEST reflects sound GRC practice?

Answer: Partly correct. The contract may shift some financial impact, but the organization stays accountable for its data, its regulatory obligations and its reputation, so the residual risk still has to be tracked and owned

Risk transfer through contracts and insurance mainly shifts financial consequences. It does not shift accountability. Regulators, customers and data subjects still hold the organization responsible for protecting the data it entrusted to the third party. The risk stays on the register with a named owner, and the transfer is recorded as a treatment that lowers financial impact, not as removal of the risk.

An organization's information security policy requires annual review, but a major acquisition closes mid-cycle, adding a subsidiary that processes regulated health data under a different legal regime. The policy owner proposes waiting for the scheduled review to avoid churn. What is the BEST governance-aligned response?

Answer: Trigger an out-of-cycle policy review driven by the material change, assessing applicability, conflicts, and needed supplemental standards before integrating the subsidiary's data

Policy lifecycle management treats material changes (mergers, new regulatory obligations, new data types) as triggers for out-of-cycle review. Waiting leaves a known compliance gap; imposing the parent policy unchanged ignores legal requirements specific to the health data; and indefinite divergence undermines enterprise governance consistency.

In the NIST RMF, information system categorization is which step of the framework?

Answer: Step 2 – Categorize

Categorize is Step 2 of the NIST RMF, occurring after the Prepare step and before the Select step.

A draft policy contains the statement: 'Systems should generally be patched in a timely manner where practical.' Which deficiency is MOST significant from a policy development and auditability perspective?

Answer: The language is vague and non-mandatory, so compliance cannot be objectively measured or enforced

Words such as 'should generally', 'timely', and 'where practical' create ambiguity and discretionary compliance, making the requirement unauditable and unenforceable. Policies should use clear mandatory language ('must') and defer specific timeframes to standards. The statement is actually lacking technical detail rather than containing too much, and naming vendor tools is not a policy-level concern.

Adequate Security is:

Answer: Commensurate with risk

Explanation: Adequate security is commensurate with risk, meaning that security measures should be proportionate to the level of risk faced by an organization. This approach ensures that resources are allocated appropriately to address the most significant risks while avoiding over or under-investment in security measures. Options a, c, and d represent incomplete or inaccurate descriptions of adequate security, as security measures should not solely be based on maximum harm, legal requirements regardless of cost, or projected budgets.

An organization cannot implement a required cryptographic control due to a legacy system limitation. The system owner proposes an alternative measure — increased physical security and strict access controls — to reduce equivalent risk. What is this called?

Answer: Compensating control

A compensating control is an alternative security measure put in place when a required control cannot be implemented due to technical, operational, or other constraints. The compensating control must provide equivalent or comparable protection. In this case, enhanced physical security and strict access controls are used to compensate for the inability to implement cryptographic controls on a legacy system.

An organization is selecting controls for a cloud-hosted system and needs to determine which controls are the responsibility of the cloud service provider (CSP) versus the agency. Which document formalizes this division of control responsibilities?

Answer: Customer Responsibility Matrix (CRM) or shared responsibility agreement

A Customer Responsibility Matrix (CRM) — sometimes called a shared responsibility matrix or control responsibility matrix — formally documents which controls are implemented by the cloud service provider, which are the customer's responsibility, and which are shared. This is a critical artifact in cloud environments and is often provided by FedRAMP-authorized CSPs. The SSP documents the controls but relies on the CRM to define ownership in inherited control scenarios.

A 'LOW' impact level in FIPS 199 indicates that loss of the security objective would have what type of effect?

Answer: Limited adverse effects on organizational operations, assets, or individuals

FIPS 199 defines LOW impact as loss of confidentiality, integrity, or availability that could be expected to have a limited adverse effect on organizational operations, assets, or individuals.

A federal agency's system is categorized Moderate under FIPS 199 and processes Privacy Act records. During the RMF Select step, the ISSO tailors the NIST SP 800-53 Rev. 5 Moderate baseline by removing a control that the system cannot technically implement. Which action is MOST consistent with the tailoring requirements of NIST SP 800-53 and SP 800-37?

Answer: Apply a compensating control or alternative implementation, document the rationale and risk acceptance in the security plan, and obtain Authorizing Official concurrence

Tailoring permits scoping, compensating controls, and parameter selection, but any deviation from the baseline must be justified and documented in the security plan, with the risk accepted by the Authorizing Official. Controls cannot be silently removed, and lowering the categorization to avoid a control is improper because categorization must reflect actual impact, including privacy-related impacts.

An organization determines that the cost of a control exceeds the potential loss it would prevent. The BEST action is to:

Answer: Accept the residual risk

When control costs exceed potential losses, accepting the residual risk is the rational response based on cost-benefit analysis.

Your critical vendor's most recent SOC 2 Type II report covers a period that ended seven months ago. To cover the gap, the vendor provides a bridge letter. What is the PRIMARY limitation you should record in the risk assessment?

Answer: The bridge letter is a management representation, not independently tested, so it gives no auditor assurance that controls worked during the gap period

A bridge (or gap) letter is written and signed by the service organization's management. It states that no material changes to the control environment have happened since the end of the report period. No auditor tests it, so it extends neither the auditor's opinion nor its assurance. It is useful but weaker evidence, and the residual risk for the gap period should be weighed accordingly. Bridge letters are used with both SOC 1 and SOC 2 reports.

A system's ATO letter specifies a 'Security-Focused Continuous Monitoring' approach with ongoing authorization. Which condition MOST accurately describes what ongoing authorization requires?

Answer: The organization has fully implemented its continuous monitoring program, the AO receives sufficient near-real-time risk information, and the AO determines on an ongoing basis that risk remains acceptable

Ongoing authorization requires the system to be under an approved continuous monitoring strategy and the AO to have timely risk information to continually determine that risk is acceptable. It is not a license to stop reviewing risk, does not require an annual full reassessment, and is not limited to Low-impact systems.

An organization is pursuing authorization of a system that processes both federal contract information and a small volume of CUI. The compliance program manager discovers that a control inherited from a FedRAMP-authorized cloud provider has a Plan of Action and Milestones (POA&M) item open on the provider's side. What is the MOST appropriate action for the system's compliance program?

Answer: Document the inherited control with its known deficiency, assess the residual risk to the system, and track the provider's POA&M item as a dependency in the system's own risk register

Inherited controls do not transfer accountability. The system owner must understand the provider's known weaknesses, evaluate how they affect the system's own risk posture, and track the dependency. A FedRAMP authorization does not mean every control is flawless, and removing the provider from the boundary or imposing a blanket closure requirement ignores risk-based decision making.

During continuous monitoring, an organization detects a significant change to a critical system. What is the most appropriate immediate action?

Answer: Assess the impact of the change on the system's security posture and update authorization documents

Significant changes trigger impact analysis to determine whether existing security controls remain adequate and whether reauthorization is needed.

A system owner's authorization package for a moderate-impact system includes a POA&M with several open weaknesses. The Authorizing Official wants to grant an ATO but is concerned that residual risk from one unresolved high-severity finding is unacceptable for the full operational environment. Under NIST SP 800-37 Rev. 2, which authorization decision best addresses this concern while still permitting limited operation?

Answer: Issue an ATO that explicitly restricts operation (for example, limiting connections, user population, or data types) or imposes conditions on the authorization decision

NIST SP 800-37 Rev. 2 lets the AO issue an ATO with terms and conditions, including restrictions on operation, when residual risk is acceptable only under limited circumstances. A time-bound condition alone does not constrain the risk in the interim. An interim authority to test applies to pre-operational testing, not to operating the system. A denial is not required when risk can be made acceptable through constraints, and it does not require restarting at Select.

During categorization of a payroll system, the system owner notes that the provisional impact level for an information type's confidentiality in NIST SP 800-60 is Low, but the organization's aggregation of 400,000 employee records, including SSNs and bank details, would cause severe harm if disclosed. Which action is most consistent with the SP 800-60 adjustment guidance?

Answer: Adjust the confidentiality impact level upward based on the aggregation and special factors, and document the rationale

SP 800-60 provisional impact levels are starting points. Organizations must review them and adjust (up or down) based on organization-specific factors such as volume of records, aggregation of PII, and mission context, documenting the rationale. Baseline selection follows categorization and cannot compensate for an inaccurate one.

An agency has a system with several open POA&M items. One High-severity item has passed its scheduled completion date because a vendor patch is unavailable, and compensating controls have been partially implemented. The AO is considering extending the ATO. Which course of action is MOST consistent with RMF risk management principles?

Answer: Update the POA&M with a revised date and milestones, reassess the residual risk with the compensating controls, and have the AO make a documented, risk-based decision on continued authorization with any conditions

A delayed POA&M item requires an updated plan with revised milestones and a reassessment of residual risk, taking the compensating controls into account. The AO then makes an informed and documented risk decision, which may include conditions or a time-limited extension. Silently extending, removing, or downgrading the item undermines the integrity of the risk management process.