CGRC Risk Management Framework 5

Question 1

A significant change is proposed: migrating a system's database tier to a new cloud service provider. Which action best aligns with the RMF Monitor step for handling this change?

Accepted Answer

Perform a security impact analysis, determine whether the change affects the authorization boundary or control effectiveness, and re-enter the appropriate RMF steps as needed before or as part of the change

Answer

The Monitor step requires an impact analysis for proposed or actual changes. Based on the results, the organization re-enters only the RMF steps needed (for example, Select, Implement, Assess) and updates the authorization package. Automatically restarting at Categorize is unnecessary, deferring updates is noncompliant, and common controls do not waive change analysis.

Question 2

A system owner's authorization package for a moderate-impact system includes a POA&M with several open weaknesses. The Authorizing Official wants to grant an ATO but is concerned that residual risk from one unresolved high-severity finding is unacceptable for the full operational environment. Under NIST SP 800-37 Rev. 2, which authorization decision best addresses this concern while still permitting limited operation?

Accepted Answer

Issue an ATO that explicitly restricts operation (for example, limiting connections, user population, or data types) or imposes conditions on the authorization decision

Answer

NIST SP 800-37 Rev. 2 lets the AO issue an ATO with terms and conditions, including restrictions on operation, when residual risk is acceptable only under limited circumstances. A time-bound condition alone does not constrain the risk in the interim. An interim authority to test applies to pre-operational testing, not to operating the system. A denial is not required when risk can be made acceptable through constraints, and it does not require restarting at Select.

Question 3

During the Prepare step at the organization level, a CISO defines common controls and designates control providers. Later, a system owner inherits a common control whose assessment evidence is more than 18 months old, and the provider's own authorization has lapsed. What is the most appropriate treatment of that control in the system's assessment?

Accepted Answer

Treat the inherited control as not currently supported by valid evidence, require the provider to reassess or reauthorize, and reflect the dependency risk in the system's authorization package

Answer

Inherited controls must be backed by current assessment and authorization evidence from the provider. If the provider's authorization has lapsed, the system owner cannot rely on stale evidence; the provider must reassess, and the dependency risk must be communicated to the AO in the package. Designation alone does not confer effectiveness, and a lapse does not make a control not applicable.

Question 4

An organization moves a system from periodic reauthorization to ongoing authorization. Which condition is REQUIRED before the AO can rely on this approach under NIST SP 800-37 Rev. 2?

Accepted Answer

An organization-defined continuous monitoring strategy is in place, and the AO has an ongoing view of security and privacy posture sufficient to determine that risk remains acceptable

Answer

Ongoing authorization requires an approved continuous monitoring strategy and sufficient, near real-time visibility for the AO to conclude that risk remains within tolerance. It does not require a particular impact level, quarterly third-party assessments of all controls, or an empty POA&M.

Question 5

Two systems share a single boundary-crossing interconnection. System A is categorized High and System B is Moderate. Which approach is most consistent with RMF guidance on managing risk from the interconnection?

Accepted Answer

Document the interconnection in both systems' security plans, with an agreement (such as an ISA/MOU) specifying responsibilities, and have each AO accept the risk the connection introduces to their own system

Answer

Interconnected systems with different impact levels remain separate authorization boundaries. Each AO must understand and accept risk introduced by the connection, with responsibilities documented in an interconnection agreement and each SSP. Using the lower baseline would expose the High system, merging systems by averaging categorization is invalid, and equal categorization is not required.

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC Risk Management Framework 5