CGRC Control Selection 5

Question 1

An organization operating a moderate-impact system discovers that a required baseline control is technically infeasible due to a legacy hardware constraint. According to NIST SP 800-37, what is the MOST appropriate course of action?

Accepted Answer

Document the infeasibility and implement a compensating control with equivalent protection

Answer

When a baseline control is technically infeasible, organizations should document the rationale and implement compensating controls that provide equivalent or comparable protection. This satisfies the intent of the control while acknowledging real-world constraints. Simply removing a control without alternatives or requesting a blanket waiver does not maintain the required security posture.

Question 2

During control selection for a cloud-hosted federal system, the system owner identifies several controls already implemented by the cloud service provider (CSP). How should these controls be classified in the system security plan?

Accepted Answer

Inherited controls, because they are provided and managed by the CSP as a common control provider

Answer

Controls implemented and managed by the cloud service provider on behalf of tenant systems are classified as inherited (common) controls. The CSP acts as the common control provider, and the system owner inherits the protection those controls provide. This distinction is essential for accurate control responsibility mapping in the SSP.

Question 3

A risk assessment reveals that a HIGH-impact system's selected control baseline does not adequately address an emerging threat specific to the organization's mission environment. What tailoring action should the security engineer take?

Accepted Answer

Augment the baseline by adding supplemental controls to address the identified threat

Answer

When a baseline does not sufficiently address identified threats, organizations should augment it by selecting additional controls or control enhancements. This is a standard tailoring action defined in NIST SP 800-53B. Downgrading the baseline or deferring without action would increase residual risk beyond acceptable levels for a HIGH-impact system.

Question 4

Which NIST publication provides the catalog from which security and privacy controls are selected during the Control Selection step of the RMF?

Accepted Answer

NIST SP 800-53 — Security and Privacy Controls for Information Systems

Answer

NIST SP 800-53 is the control catalog used during RMF Step 2 (Select). It provides the full set of security and privacy controls and enhancements from which organizations select and tailor controls for their systems. SP 800-37 governs the overall RMF process, SP 800-30 supports risk assessments, and SP 800-60 guides security categorization.

Question 5

An organization is selecting controls for a system that processes both Controlled Unclassified Information (CUI) and publicly available data. The security categorization resulted in a MODERATE overall impact level. Which baseline should serve as the STARTING point for control selection?

Accepted Answer

MODERATE baseline, tailored based on the specific characteristics of the system

Answer

The MODERATE impact level determined through security categorization maps directly to the MODERATE control baseline as the starting point. Tailoring then adjusts controls based on system-specific factors such as environment, threat, and mission needs. Using a LOW baseline ignores the CUI requirements, and escalating to HIGH without justification would be excessive and unsupported.

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC Control Selection 5