CGRC Control Selection 3

Question 1

A security engineer is selecting controls for a system that processes Controlled Unclassified Information (CUI) for a federal agency. Which NIST publication provides the baseline control catalog they should start with?

Accepted Answer

NIST SP 800-53

Answer

NIST SP 800-53 provides the comprehensive catalog of security and privacy controls for federal information systems and organizations. While SP 800-171 derives from SP 800-53 and applies to CUI in non-federal systems, the primary control catalog for federal agencies is SP 800-53. SP 800-37 covers the Risk Management Framework process, and SP 800-60 maps information types to security categories.

Question 2

During control selection, an organization determines that implementing a required baseline control would cost $500,000 annually but only protects against a risk with an expected loss of $50,000 per year. What is the most appropriate course of action?

Accepted Answer

Apply for a control tailoring adjustment, potentially replacing it with a compensating control or adjusting implementation

Answer

Tailoring allows organizations to adjust baseline controls based on organizational conditions, operational environments, and risk assessments. When a control is cost-prohibitive relative to the risk it mitigates, the organization should use the tailoring process — which may include scoping guidance, substituting compensating controls, or documenting the rationale — rather than blindly implementing or ignoring the control. This must be documented and approved by the authorizing official.

Question 3

Which factor is considered FIRST when determining the appropriate security control baseline for a federal information system?

Accepted Answer

The FIPS 199 security categorization of the system

Answer

The FIPS 199 security categorization — which determines whether a system is Low, Moderate, or High impact based on confidentiality, integrity, and availability — is the primary driver for selecting the initial control baseline. A Low impact system uses the SP 800-53B Low baseline, Moderate uses the Moderate baseline, and High uses the High baseline. Budget, interconnections, and user count may influence tailoring decisions afterward, but categorization comes first.

Question 4

An organization is selecting controls for a cloud-hosted system and needs to determine which controls are the responsibility of the cloud service provider (CSP) versus the agency. Which document formalizes this division of control responsibilities?

Accepted Answer

Customer Responsibility Matrix (CRM) or shared responsibility agreement

Answer

A Customer Responsibility Matrix (CRM) — sometimes called a shared responsibility matrix or control responsibility matrix — formally documents which controls are implemented by the cloud service provider, which are the customer's responsibility, and which are shared. This is a critical artifact in cloud environments and is often provided by FedRAMP-authorized CSPs. The SSP documents the controls but relies on the CRM to define ownership in inherited control scenarios.

Question 5

When applying scoping considerations during control selection, an organization determines that a particular control applies to physical and environmental protection but their system is entirely cloud-based with no physical infrastructure. What scoping guidance applies?

Accepted Answer

The control can be designated as 'Not Applicable' with documented rationale, or inherited from the CSP

Answer

Scoping considerations in NIST SP 800-53B allow organizations to designate controls as Not Applicable when they are not relevant to the system's operational environment — provided the rationale is documented in the SSP. For physical controls in a cloud environment, these are typically inherited from the cloud service provider's FedRAMP authorization package rather than implemented independently. This is a legitimate and common application of scoping guidance.

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC Control Selection 3