CGRC Practice Question: A system owner determines that a specific NIST 800-53 control cannot be implemented due…
A system owner determines that a specific NIST 800-53 control cannot be implemented due to legacy hardware constraints. They choose to implement a different control to mitigate the same risk. This is an example of what?
⚠ Common exam trap
CGRC often tests the distinction between compensating controls and risk acceptance; candidates may think that if a control cannot be implemented, the only option is to accept the risk, but compensating controls are the correct answer when an alternative is implemented.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Compensating Control.
This is an example of a compensating control. A compensating control is an alternative control implemented when the original control cannot be applied due to constraints, but it still mitigates the same risk. The system owner is substituting a different control to achieve the same security objective, which is the definition of a compensating control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Risk Acceptance.
Why it's wrong here
Risk acceptance retains the residual exposure and formally documents it, without substituting anything; here a compensating control is actually applied, so the risk is mitigated rather than accepted. Acceptance is tempting because legacy constraints often force it, and it would be correct only when no compensating control exists and management signs off on the exposure.
- ✗
Baseline Tailoring.
Why it's wrong here
Tailoring selects or scopes controls from the baseline to fit the system, but it does not introduce a substitute control that differs from the catalogue entry. It is tempting because legacy constraints do drive scoping decisions, and tailoring would be correct when controls are omitted or parameterised, not replaced by an alternative mitigating mechanism.
- ✗
Control Supplementation.
Why it's wrong here
Supplementation adds controls beyond the baseline to strengthen coverage, whereas this scenario swaps an unimplementable control for a different one achieving the same objective. It is tempting because both involve adding controls, and supplementation would be correct when the baseline is insufficient and extra controls are layered on rather than substituted.
- ✓
Compensating Control.
Why this is correct
Legacy hardware prevents the baseline NIST 800-53 control from being met, so an alternative control is applied to reduce the same risk to an acceptable level. That substitution, driven by the implementation constraint, is precisely what defines a compensating control.
About these practice questions
One of 341 original CGRC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
You might also like
Similar CGRC questions
- Your organization is applying NIST SP 800-53 controls to a hybrid cloud infrastructure. What is the main purpose of util…
- A security architect is selecting controls for a new payroll processing system that handles PII and is deployed on-premi…
- When selecting controls, you notice that a specific NIST 800-53 control includes 'assignment' statements. What is the pu…
- You are developing a security plan for a system that uses a NIST SP 800-53 control baseline. During control selection, y…
- You are selecting controls for a system that must comply with both NIST SP 800-53 and the Payment Card Industry Data Sec…
Written and reviewed by Johnson Ajibi, MSc IT Security
Security Systems Architect · founder of Courseiva
Last reviewed September 2026 · checked against the official (ISC)² exam blueprint
This CGRC practice question is part of Courseiva's free (ISC)² certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CGRC exam.