CGRC Study Guide 2026

FIPS 199 defines High as a severe or catastrophic adverse effect, Moderate as serious, and Low as limited. The potential impact value is determined by the worst effect across organizational operations, organizational assets, individuals, other organizations, or the Nation. Here the effect on individuals is described as serious, which is Moderate, so option 3 as written is mistaken; the correct reading is that the rating is the highest of the effects, which is Moderate.

SP 800-137 states that frequencies should be driven by control volatility, system categorization/impact, control criticality, threat and vulnerability information, risk assessment results, and reporting requirements of the organization. A vendor tool's default reporting cadence is an implementation detail and should not determine how often an organization needs assurance about a control.

Categorize is Step 2 of the NIST RMF, occurring after the Prepare step and before the Select step.

Explanation: Adequate security is commensurate with risk, meaning that security measures should be proportionate to the level of risk faced by an organization. This approach ensures that resources are allocated appropriately to address the most significant risks while avoiding over or under-investment in security measures. Options a, c, and d represent incomplete or inaccurate descriptions of adequate security, as security measures should not solely be based on maximum harm, legal requirements regardless of cost, or projected budgets.

FIPS 199 defines LOW impact as loss of confidentiality, integrity, or availability that could be expected to have a limited adverse effect on organizational operations, assets, or individuals.

When control costs exceed potential losses, accepting the residual risk is the rational response based on cost-benefit analysis.