CGRC System Compliance — 15 Questions

Question 1

Which role is responsible for the ongoing monitoring of security controls after an ATO is granted?

Accepted Answer

Information System Security Officer (ISSO). The Information System Security Officer (ISSO) is the role designated in the RMF (NIST SP 800-37) to perform continuous monitoring of security controls after an Authorization to Operate (ATO) is granted. The ISSO maintains the system's security posture by tracking control effectiveness, managing POA&Ms, and reporting status to the Authorizing Official. This ongoing operational responsibility is distinct from the authorization decision itself.

Answer

Authorizing Official

Answer

Chief Information Security Officer (CISO)

Answer

Security Control Assessor (SCA)

Question 2

Which TWO documents are essential for an Authorizing Official to make an informed risk-based decision?

Accepted Answer

Plan of Action and Milestones (POA&M). The Plan of Action and Milestones (POA&M) (C) is essential because it documents known weaknesses, the planned remediation actions, resources required, and milestone dates, giving the Authorizing Official the residual-risk picture needed to decide whether to grant an authorization. The Security Assessment Report (SAR) (D) is essential because it presents the independent assessor's findings on the effectiveness of implemented controls, including the severity of deficiencies, which the AO must weigh against the POA&M and SSP to make a risk-based decision. Together these two artifacts supply the assessment results and the remediation/risk-acceptance data that directly inform the authorization decision. The System Security Plan (A) is important context but describes the control implementation rather than the assessed risk posture, so it is not one of the two essential decision documents here. The Hardware inventory list (B) and Network diagram (E) are supporting artifacts that feed into the SSP and assessment process but do not by themselves provide the risk findings and remediation commitments the AO needs.

Answer

System Security Plan (SSP)

Answer

Hardware inventory list

Answer

Network diagram

Question 3

During the compliance determination phase, you discover that a legacy application lacks multi-factor authentication (MFA) but is isolated within a physically secured enclave. Which action should you take to document this in the Security Assessment Report (SAR)?

Accepted Answer

Document the compensating control and assess its effectiveness. When a required control (MFA) is absent but an alternative control (physically secured enclave) provides equivalent or compensating protection, the correct action is to document the compensating control and assess whether it effectively mitigates the risk. The SAR should record the gap, the compensating control, the assessment of its effectiveness, and any residual risk so the Authorizing Official can make an informed risk decision.

Answer

Force an upgrade to the application

Answer

Immediately revoke the Authorization to Operate (ATO)

Answer

Mark the control as 'Not Applicable'

Question 4

An Authorizing Official (AO) is reviewing a Plan of Action and Milestones (POA&M) for a high-impact system. What is the AO's primary responsibility regarding this document?

Accepted Answer

Accepting the residual risk associated with the POA&M. The Authorizing Official (AO) is the senior official who formally accepts the residual risk of operating a system, and the POA&M documents known weaknesses and planned mitigations. The AO's primary responsibility is to review the POA&M and decide whether the residual risk is acceptable, granting or denying authorization to operate. This risk-acceptance role is the core of the RMF authorization decision.

Answer

Drafting the mitigation tasks

Answer

Conducting the security controls assessment

Answer

Implementing the technical patches

Question 5

An Authorizing Official grants an 'ATO with Conditions.' What does this mean for the system owner?

Accepted Answer

The system must meet specific security requirements to remain authorized. An 'ATO with Conditions' means the Authorizing Official permits the system to operate, but only if the system owner implements and maintains specific security controls, mitigations, or reporting requirements within defined timeframes. Continued authorization is contingent on satisfying those conditions; failure to do so can result in revocation.

Answer

The system is unauthorized for production use

Answer

The system is prohibited from processing sensitive data

Answer

The system is permanently compliant

Question 6

You are utilizing the NIST SP 800-37 R2 process for an Authorization to Operate (ATO). At what point is the Security Assessment Report (SAR) presented to the Authorizing Official?

Accepted Answer

After the 'Assess' step and before the 'Authorize' step. In NIST SP 800-37 R2, the RMF steps are Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor. The Security Assessment Report (SAR) is produced during the Assess step and is presented to the Authorizing Official as a key input to the Authorize step, where the AO makes the ATO decision. Thus the SAR is delivered after Assess and before Authorize.

Answer

During the 'Categorize' step

Answer

After the 'Monitor' step

Answer

During the 'Prepare' step

Question 7

You are performing a compliance determination on a system that shares data with an external partner. What is the most important factor in the authorization boundary determination?

Accepted Answer

The ownership and control of the components. The authorization boundary is defined by the set of components that the authorizing official has authority over — i.e., ownership and control. When data is shared with an external partner, the boundary must be drawn where the organization's control ends and the partner's begins, because the AO can only accept risk for systems they own or control. Cost, physical location, and user count do not determine who is accountable for the risk.

Answer

The cost of the hardware

Answer

The physical location of the server racks

Answer

The number of users accessing the system

Question 8

While reviewing a system's compliance, you notice the Security Control Assessor (SCA) used an interview method for a technical control that requires automated testing. How should you address this in your review?

Accepted Answer

Request a re-assessment using the 'Test' method. Requesting a re-assessment using the 'Test' method is correct because technical controls require objective, hands-on examination (e.g., scanning, configuration review, penetration testing) rather than subjective interviews. An interview alone cannot verify that a technical control is implemented and operating effectively. The assessor must use the appropriate assessment method defined in the assessment plan.

Answer

Accept the findings as-is

Answer

Escalate to the Chief Information Officer (CIO)

Answer

Update the System Security Plan (SSP) to match the interview

Question 9

An information system security officer (ISSO) is preparing the Security Assessment Plan (SAP) in the NIST Risk Management Framework. Which component must be identified first to ensure the assessment coverage is adequate?

Accepted Answer

System boundary and authorization boundary. Before an ISSO can develop a Security Assessment Plan (SAP), the system boundary and authorization boundary must be defined, because they determine which controls, components, and interfaces fall within assessment scope. Without a clearly identified boundary, assessment coverage cannot be judged adequate and controls may be missed or over-scoped.

Answer

Security control baselines

Answer

Contingency plan testing

Answer

Risk acceptance threshold

Question 10

When determining compliance for a cloud-based service, which document serves as the primary evidence of the provider's security controls?

Accepted Answer

The cloud provider's System Security Plan (SSP) or Authorization Package. The cloud provider's System Security Plan (SSP) or authorization package is the primary evidence of implemented security controls, because it documents control descriptions, implementation statements, and supporting artifacts mapped to a framework such as NIST SP 800-53 or FedRAMP. It is the authoritative artifact a customer or auditor reviews to determine whether the provider's controls meet compliance requirements.

Answer

The service level agreement (SLA)

Answer

The organization's internal risk register

Answer

The network topology map

Question 11

What is the purpose of the Security Assessment Report (SAR)?

Accepted Answer

To provide a snapshot of the control implementation effectiveness. The Security Assessment Report (SAR) is a key deliverable of the security assessment phase within the Risk Management Framework (RMF). Its primary purpose is to document the findings from assessing the security controls, including whether each control is implemented correctly, operating as intended, and producing the desired outcome. This provides a snapshot of control implementation effectiveness, which decision-makers use to determine residual risk and inform authorization decisions. The SAR does not itself authorize the system; that is the role of the Authorization to Operate (ATO).

Answer

To request funding for security improvements

Answer

To authorize the system for production

Answer

To list all authorized users

Question 12

Which document provides the formal authority to operate a system?

Accepted Answer

Authorization Decision Document. The Authorization Decision Document (also called the Authorization to Operate, ATO, or in NIST RMF terms the authorization package's decision) is the formal artifact in which the Authorizing Official accepts the risk and grants authority to operate the system. It is the official record that the system may be placed into operation based on the assessed controls and residual risk.

Answer

System Security Plan

Answer

Risk Assessment Report

Answer

Security Control Assessment

Question 13

You are auditing an organization's POA&M process. Which of the following indicates an ineffective process?

Accepted Answer

The POA&M lists items with no completion dates. An ineffective POA&M process is indicated by listing items with no completion dates, because POA&Ms require milestones and estimated completion dates to track remediation progress. Without dates, there is no accountability or timeline for resolving weaknesses, which violates FedRAMP and NIST SP 800-37 requirements. The other options describe positive attributes of an effective POA&M process.

Answer

The POA&M contains vulnerabilities found by automated scans

Answer

The POA&M is stored in a secure repository

Answer

The POA&M is reviewed by the CISO

Question 14

A system is found to have a critical vulnerability that cannot be patched. You are documenting a risk acceptance request. What is the most critical piece of information to include for the AO?

Accepted Answer

The potential impact on the organization's mission. The Authorizing Official (AO) is the senior official who accepts risk on behalf of the organization, so the risk acceptance request must articulate the mission/business impact of the unpatched vulnerability. Under NIST RMF (SP 800-37), the AO's decision hinges on how the vulnerability affects organizational operations, assets, and mission/business functions — not on technical severity alone. The potential mission impact is what allows the AO to make an informed, accountable risk decision.

Answer

The estimated cost of an upgrade

Answer

The manufacturer's release notes

Answer

The CVSS score of the vulnerability

Question 15

When a system is undergoing a major change, what is the impact on the existing ATO?

Accepted Answer

The ATO must be re-evaluated. Under NIST RMF (SP 800-37) and FedRAMP continuous monitoring guidance, an ATO is tied to a specific, baselined system configuration and the risk determination made at the time of authorization. A major change—such as new functionality, a new data type, a new interconnection, or a significant architecture shift—invalidates that risk determination because the security posture may have materially changed. The AO must therefore have the change re-assessed (a reauthorization or significant-change review) before the system can continue operating under the existing authorization.

Answer

The ATO is suspended until the next fiscal year

Answer

The ATO remains valid until the expiration date

Answer

The ATO is automatically extended