CGRC Control Selection 4

Question 1

A security engineer is reviewing the control baseline for a new cloud-hosted financial system. The system processes highly sensitive PII and is categorized as HIGH impact. Which NIST SP 800-53 baseline should serve as the STARTING POINT for control selection?

Accepted Answer

HIGH baseline, tailored further based on system-specific risk factors

Answer

NIST RMF guidance specifies that the initial control baseline is selected based on the system's impact level. A HIGH-impact system starts with the HIGH baseline from NIST SP 800-53B. Organizations then tailor that baseline — adding, removing, or modifying controls — based on specific risk factors, but always starting from the appropriate impact-level baseline.

Question 2

During Step 3 (Select) of the NIST RMF, an organization identifies that several HIGH-baseline controls are not applicable because the system has no external network connectivity. What tailoring action is appropriate?

Accepted Answer

Scoping the controls out as not applicable based on the system's operational environment

Answer

Scoping is a tailoring action that allows organizations to exclude controls that are not applicable given the system's environment, technology, or operational constraints. When a system lacks external network connectivity, network-related controls may be legitimately scoped out. This is distinct from compensating controls, which substitute an equivalent control when the original cannot be implemented.

Question 3

An organization cannot implement a required cryptographic control due to a legacy system limitation. The system owner proposes an alternative measure — increased physical security and strict access controls — to reduce equivalent risk. What is this called?

Accepted Answer

Compensating control

Answer

A compensating control is an alternative security measure put in place when a required control cannot be implemented due to technical, operational, or other constraints. The compensating control must provide equivalent or comparable protection. In this case, enhanced physical security and strict access controls are used to compensate for the inability to implement cryptographic controls on a legacy system.

Question 4

Which document formally captures the selected controls, tailoring decisions, and planned implementation details for an information system during the NIST RMF Select step?

Accepted Answer

System Security Plan (SSP)

Answer

The System Security Plan (SSP) is the primary document produced and updated during Step 3 (Select) of the RMF. It documents the system boundary, control baseline, tailoring decisions, control implementation descriptions, and responsibilities. The POA&M tracks remediation of weaknesses; the SAR documents assessment findings; the ATO is the authorization decision itself.

Question 5

A CGRC practitioner is advising on control selection for a system shared by multiple programs within an agency. Several of the required controls are already implemented at the organizational level and maintained by a central team. How should these be treated?

Accepted Answer

Inherited as common controls, referencing the providing system's SSP

Answer

Common controls are controls that are implemented at an organizational, site, or program level and inherited by multiple systems. When a system can inherit a control from a common control provider, it should document this inheritance in its SSP, referencing the authoritative source. This avoids duplication of effort and leverages centrally managed security capabilities. Common controls must be documented and authorized, not simply assumed.

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC Control Selection 4