CGRC Practice Question: A control in the NIST 800-53 catalog has a parameter that reads: '[Assignment:…
A control in the NIST 800-53 catalog has a parameter that reads: '[Assignment: organization-defined frequency]'. What is your responsibility as the system owner?
⚠ Common exam trap
CGRC often tests the misconception that NIST provides default values for assignment parameters — candidates must recognize that the organization (system owner) is responsible for defining them based on policy and risk.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Define the frequency based on organizational policy.
In NIST SP 800-53, '[Assignment: organization-defined frequency]' is an explicit placeholder indicating that the organization must fill in the value as part of tailoring the control. The system owner, in coordination with the Authorizing Official and organizational policy, defines the frequency (e.g., annually, quarterly) and documents it in the system security plan. Leaving it blank or removing the control would break the control baseline and fail assessment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use the default value provided in the appendix.
Why it's wrong here
The bracketed assignment marker means the organisation must supply its own value; adopting the appendix default bypasses that obligation. Defaults are acceptable only where the catalog labels a parameter as non-assignment, which this one is not.
- ✗
Remove the control since it is not fully defined.
Why it's wrong here
Removing the control discards a required NIST 800-53 safeguard merely because its parameter is unfilled, rather than supplying the organisation-defined frequency. Deletion is tempting when a control appears incomplete, but tailoring may only remove controls that are genuinely inapplicable, documented in the SSP with justification.
- ✗
Leave the assignment blank.
Why it's wrong here
Leaving the parameter blank abandons the organisation-defined value the control requires, so the control cannot be implemented or assessed. It is tempting when the catalog text looks incomplete, but assignments exist precisely to be filled in; a blank is only acceptable where the control explicitly permits no value.
- ✓
Define the frequency based on organizational policy.
Why this is correct
Assignment parameters are deliberately left blank in NIST 800-53 so the organisation fills them in. As system owner, you select the frequency value that matches your organisational policy, risk tolerance and operational context, then document it in the control implementation statement.
About these practice questions
One of 341 original CGRC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
You might also like
Similar CGRC questions
- You are tailoring a baseline and encounter a control marked as 'Not Applicable'. What is the correct documentation appro…
- Which TWO of the following are valid reasons for tailoring a NIST 800-53 control baseline?
- A system owner determines that a specific NIST 800-53 control cannot be implemented due to legacy hardware constraints.…
- Your organization is applying NIST SP 800-53 controls to a hybrid cloud infrastructure. What is the main purpose of util…
- A security architect is selecting controls for a new payroll processing system that handles PII and is deployed on-premi…
Written and reviewed by Johnson Ajibi, MSc IT Security
Security Systems Architect · founder of Courseiva
Last reviewed September 2026 · checked against the official (ISC)² exam blueprint
This CGRC practice question is part of Courseiva's free (ISC)² certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CGRC exam.