CGRC Control Selection 1

Question 1

An organization is implementing a new cloud-based payroll system that processes sensitive employee data. During control selection, the security team must choose between implementing a hardware security module (HSM) or software-based encryption. Which NIST SP 800-53 control family is MOST directly relevant to this decision?

Accepted Answer

System and Communications Protection (SC)

Answer

System and Communications Protection (SC) directly governs cryptographic protection mechanisms, including encryption of data in transit and at rest. SC controls address the use of cryptographic modules (like HSMs) and encryption algorithms to protect sensitive information, making it the most relevant control family for this decision.

Question 2

A federal agency is selecting controls for a moderate-impact system. The system owner wants to add a biometric authentication control that is not in the NIST SP 800-53 baseline. What is the correct term for this type of control addition?

Accepted Answer

Supplemental control

Answer

When an organization adds controls beyond the baseline to address specific threats or risks not fully mitigated by the baseline, these are called supplemental controls. Supplemental controls are selected based on risk assessment findings and organizational needs beyond what the standard baseline requires.

Question 3

During control selection, a system owner discovers that implementing the required physical access control for a remote server closet would cost $200,000, while the asset being protected is valued at $50,000. Which principle should guide the control selection decision in this scenario?

Accepted Answer

Cost-benefit analysis

Answer

Cost-benefit analysis is a foundational principle in control selection that ensures the cost of implementing a control does not exceed the value of the asset being protected or the potential loss from a risk. In this case, spending $200,000 to protect a $50,000 asset is not economically justified, and alternative controls should be considered.

Question 4

A CGRC practitioner is reviewing the System Security Plan (SSP) and notices that some controls are marked as 'inherited' from a common control provider. What does inheriting a control mean in the context of the RMF?

Accepted Answer

The system receives the security capability from an external provider and does not need to re-implement it

Answer

In the RMF, inheriting a control means the system leverages a security capability already implemented by a common control provider (e.g., a data center's physical security or a shared authentication service). The inheriting system documents this in its SSP and relies on the provider's authorization rather than re-implementing the control itself.

Question 5

An organization is selecting controls for a HIGH-impact system under NIST SP 800-53. Which document provides the STARTING POINT for selecting the initial control baseline?

Accepted Answer

NIST SP 800-53B (Control Baselines)

Answer

NIST SP 800-53B provides the control baselines — LOW, MODERATE, and HIGH — that serve as the starting point for control selection. Once the system is categorized (using FIPS 199), practitioners turn to SP 800-53B to identify the appropriate baseline, which is then tailored based on risk assessment results and organizational factors.

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC Control Selection 1