CGRC Control Selection 6

Question 1

An organization is implementing controls for a newly classified moderate-impact system. The security engineer notes that NIST SP 800-53 provides a baseline, but some controls seem unnecessary given the system's unique operating environment. What is the MOST appropriate next step?

Accepted Answer

Tailor the control baseline by documenting justifications for any additions, removals, or modifications

Answer

Tailoring is a formal process within RMF that allows organizations to adjust the control baseline to fit their specific environment, mission, and risk tolerance. Any modifications must be documented with justifications. Simply implementing all controls without tailoring ignores legitimate organizational needs, while removing controls without documentation bypasses required governance.

Question 2

A CGRC practitioner is reviewing control selection for a federal information system. The system stores personally identifiable information (PII) and is categorized as HIGH for confidentiality. Which NIST publication provides the privacy control overlay that should be considered alongside the security control baseline?

Accepted Answer

NIST SP 800-53 Appendix J (Privacy Controls)

Answer

NIST SP 800-53 Appendix J contains the privacy control catalog and overlay, which provides controls specifically designed to address privacy risks associated with PII. When a system handles PII, privacy controls from this appendix must be considered alongside the security control baseline derived from the system's impact categorization.

Question 3

During control selection, a risk analyst identifies that a required baseline control would cost significantly more to implement than the potential loss from the risk it mitigates. The organization decides not to implement the control. This decision is BEST described as:

Accepted Answer

Risk acceptance with documented justification

Answer

When an organization consciously decides not to implement a control because the cost outweighs the benefit and accepts the residual risk, this is risk acceptance. Proper risk acceptance requires documentation and authorization from the appropriate official. Risk avoidance eliminates the activity causing the risk, compensation involves alternative controls, and transference shifts risk to another party.

Question 4

A security architect is selecting controls for a cloud-based system shared by multiple agencies. Some security controls are implemented by the cloud service provider (CSP) rather than individual agency tenants. How should inherited controls be handled in the agency's System Security Plan (SSP)?

Accepted Answer

Inherited controls should be documented in the SSP with a reference to the authoritative source and leveraged authorization

Answer

Inherited controls are controls implemented by an external provider (like a CSP) that an agency leverages. They must still be documented in the agency's SSP, identifying them as inherited and referencing the provider's authorization documentation (e.g., FedRAMP authorization). This ensures traceability and accountability while avoiding redundant implementation.

Question 5

An organization is selecting controls for a system that processes sensitive but unclassified information. They want to apply a community-developed set of additional controls beyond the NIST baseline for their specific industry sector. In RMF terminology, this additional set of controls is called a:

Accepted Answer

Control overlay

Answer

A control overlay is a fully specified set of controls, control enhancements, or supplemental guidance tailored for a specific technology, environment, or community of interest. Overlays allow sectors (such as healthcare, financial, or defense) to add community-specific requirements on top of the NIST baseline. Control enhancements add functionality to individual controls, compensating controls substitute for required controls, and scoping considerations justify removing or modifying controls.

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC Control Selection 6