(ISC)2 Certified in Governance, Risk and Compliance (CGRC) (CGRC) (CGRC) — Questions 76–150

Network architecture diagrams show the physical and logical placement of components, enclaves and connections, letting the Authorizing Official verify which assets sit inside the accreditation boundary. They expose boundary crossings and external links that textual descriptions may omit.

This is correct because continuous monitoring requires evaluating changes and new threats to determine their potential impact on the system. Even if the component is outside the boundary, its use by administrators could introduce risk. A security impact analysis helps decide if the ATO remains valid or if remediation is necessary.

A common control is implemented once and inherited by multiple systems. The centralized identity management system provides authentication for the portal along with other systems, so documenting it as a common control correctly captures that the portal inherits this capability. This avoids redundant implementation and assessment, and aligns with NIST SP 800-53 guidance on common controls and inheritance.

When a control is deemed not applicable, NIST SP 800-53 requires documenting the decision in the system security plan (SSP) along with a justification. This ensures transparency and supports the risk management process. Simply removing the control without documentation would violate the requirement to maintain an accurate control baseline and could lead to gaps in the authorization package. Therefore, this is the correct action.

Sampling selects a representative subset of a population for testing, letting auditors draw conclusions about the whole without examining every item. This satisfies the audit constraint of gaining sufficient evidence efficiently when full-population testing is impractical.

When a control is only partially implemented, the SSP must accurately reflect that status, including the specific gap, planned remediation actions, and a target date. This transparency supports risk-based decision-making by the Authorizing Official. Documenting the partial implementation also allows continuous monitoring to track progress and ensures the assessment report aligns with the SSP, maintaining the integrity of the authorization package.

In virtualized environments, logical separation (e.g., hypervisor-based isolation, VLANs) can provide equivalent protection to physical separation. Tailoring allows for such substitutions when justified by risk assessment. This ensures that the security objective is met without unnecessary physical controls.

Assignment values must align with organisational policy, otherwise the control's parameters are set inconsistently across the system and the resulting baseline no longer reflects management's intent. This satisfies the stem's requirement that assignments be managed correctly, since policy-consistent values keep the control implementation defensible and auditable.

The POA&M is the primary tool for documenting known weaknesses that require remediation, along with the planned actions, resources, and milestones. It enables the ISSO and system owner to track progress and provides the Authorizing Official with visibility into residual risk. This supports continuous monitoring and informed authorization decisions.

Tailoring allows organizations to add, modify, or remove controls based on risk. Since the threat is specific and not covered by the low baseline, adding a relevant control or enhancement directly addresses the risk while maintaining the low baseline's proportionality. This is consistent with NIST SP 800-53B and the RMF step of control selection, where tailoring is used to meet unique organizational needs.

The Monitor phase of the RMF is where continuous monitoring activities occur, assessing control effectiveness and tracking changes on an ongoing basis. This satisfies the stem's requirement by placing ongoing control monitoring within the correct RMF phase.

Segmenting POS systems into a dedicated VLAN with strict firewall rules limits communication to only necessary endpoints, such as the payment processor. This reduces the attack surface and helps contain breaches. PCI-DSS requires network segmentation to protect cardholder data environments. This approach is a standard method to achieve isolation while permitting required traffic.

Governance establishes structure, direction, and accountability so that risk and compliance work supports business objectives rather than operating in departmental silos. For a company moving away from informal practices, this alignment and clear ownership is precisely the value being sought. It also gives leadership a consistent basis for oversight and decision-making across the enterprise.

A configuration baseline captures the approved, documented security settings a system must maintain, providing the reference against which actual configurations are compared during compliance audits. This satisfies the need to detect drift from sanctioned hardening standards.

NIST SP 800-37 and FIPS 199 require the boundary to encompass all components that process, store, or transmit information, as well as those that enforce security controls for the system. The identity provider enforces authentication and access, so it is part of the system's security posture. Including it ensures a complete risk assessment and accurate categorization. This approach correctly reflects the system's true scope.

Reviewing security log correlation exposes attacks that controls failed to stop, revealing false negatives. Correlating events across sources surfaces activity that individual controls missed, directly satisfying the stem's requirement to detect gaps where threats slipped through undetected. This mechanism identifies control failures rather than confirming successful prevention.

A compliance program charter is the foundational governance document that formally establishes the program's authority, scope, roles, responsibilities, and reporting lines. Because leadership wants documented and approved structure before control testing, the charter is the logical first deliverable. It provides the mandate that later artifacts such as risk assessments and control matrices depend upon for legitimacy and resource allocation.

A dynamic link propagates audit testing results directly into the control effectiveness score, so residual risk recalculates from current evidence rather than stale manual values. This satisfies the requirement that control effectiveness reflect the latest audit results automatically.

Change management approval enforces documented review, testing and authorisation before production deployment, satisfying the stem's requirement for an administrative control applied beforehand. It ensures the security tool's introduction is assessed for risk, impact and rollback, providing governance oversight that technical safeguards alone cannot deliver.

The LOW baseline in NIST SP 800-53B provides a starting set of controls specifically for low-impact systems. Tailoring allows removal of controls that are not applicable to the specific system, which is the correct approach to reduce the control set while maintaining a defensible baseline.

Configuration management maintains an accurate inventory of system components and their baselines, which continuous monitoring depends on to track changes. Without it, assessments and status reporting would reference stale or unknown system states, so it satisfies the stem's necessary element for compliance.

Absent audit logging for administrative actions removes accountability and traceability for privileged changes. Enabling audit logging captures who did what and when, restoring the detective control the organisation currently lacks and satisfying the assessment's requirement for monitoring privileged access.

An ATO with Conditions authorises operation only while the system owner remediates specified weaknesses within agreed timeframes. The authorisation remains valid contingent on meeting those security requirements; failure to satisfy them can trigger revocation or suspension of the authority to operate.

Physical building access badges operate across all systems within a facility, so a single implementation satisfies the security requirement for every system hosted there. This shared, inherited nature is precisely what defines a common control, contrasting with system-specific controls tailored to one information system's particular needs.

The AO must be informed of overdue POA&M items because they may affect the risk decision. Reassessing the risk ensures the authorization remains valid. NIST SP 800-37 emphasizes ongoing communication with the AO regarding changes in risk. This action maintains compliance by ensuring the AO can make informed decisions.

In FedRAMP, when a control is not fully implemented, the assessor documents it as a finding in the SAR. The CSP then has the opportunity to address the finding through a POA&M, which outlines remediation actions, timelines, and responsible parties. This is a standard part of the assessment process, allowing for continuous monitoring and improvement. The AO considers the SAR and POA&M when making authorization decisions.

Mapping risk categories to specific business processes links each risk to the value stream it threatens, so treatment priorities follow business criticality. This connects GRC decisions to operational and strategic objectives rather than abstract risk registers.

Configuring password length and lockout thresholds via Group Policy or Local Security Policy enforces restrictions through the operating system's authentication mechanism. This is a technical control because it is implemented in software and automatically enforces the policy without human intervention, directly aligning with the CGRC domain of control implementation.

A CRL Distribution Point publishes the signed list of revoked certificates so relying parties can check revocation status during validation. Configuring it in AD CS satisfies the stem's requirement that compromised certificates be revocable, since revocation only takes effect when clients can retrieve the CRL from that location.

A preventive technical control, such as role-based access control (RBAC) enforced by the application, is designed to stop unauthorized access before it occurs. Since the CISO requires access restrictions based on data sensitivity and user role, and it must be evaluated during design, this aligns with a preventive technical control implemented via access control mechanisms like mandatory access control or attribute-based access control.

Once assessed risks exceed the organisation's defined risk appetite or tolerance, treatment plans specify the response — mitigate, transfer, avoid or accept — plus owners, controls and target dates. This closes the Risk Management loop by converting unacceptable exposure into tracked, accountable remediation activity.

A mantrap is a physical control comprising two interlocking doors, admitting one person at a time. It satisfies the stem's requirement to prevent piggybacking by ensuring each individual is authenticated before the second door releases, so an unauthorised follower cannot tailgate through.

NIST SP 800-53B, titled 'Control Baselines for Information Systems and Organizations,' provides the security and privacy control baselines for low, moderate, and high-impact systems. It is the authoritative source for selecting the initial control set based on impact level. Therefore, this is the correct publication.

A control overlay maps a standardised, reusable control set onto a specific technology stack, so the same controls apply consistently across deployments. This satisfies the stem's cloud scenario by removing the need to author bespoke controls per platform, giving repeatable compliance coverage.

Data encryption is a critical security control that must be evaluated during a migration. The new provider's encryption methods must meet the same or stronger standards as the original environment to protect sensitive data. If encryption is weaker or not implemented correctly, it could lead to data exposure and non-compliance. The security impact analysis must verify that encryption controls are equivalent or better, ensuring the system's risk profile remains acceptable.

Credentialed scans authenticate to the target host, allowing the scanner to read installed patch levels, registry settings and configuration files. This depth reveals missing patches and misconfigurations that unauthenticated scans miss, since those only inspect exposed network services.

Updating the asset inventory database records the server's removal, ensuring the configuration management system reflects reality and no stale entries trigger audits or misdirect incident response. This satisfies the decommissioning requirement to maintain accurate asset visibility, preventing orphaned records that could mask unaccounted sensitive data or obscure accountability during compliance reviews.

The major architecture change invalidates the relevance of the six-month-old tabletop exercise. Evidence must be sufficient and appropriate for the period under review, and a significant change can alter the effectiveness of contingency planning. The assessor should have obtained updated evidence, such as a recent exercise or test, that reflects the new architecture. Relying on stale evidence is a critical deficiency.

Overlays must reflect what the system actually does, so mission or business requirements drive which additional controls are layered onto the baseline. This ensures the overlay supports the system's purpose, satisfying the stem's requirement for a factor considered when applying overlays.

A Risk Management Charter is the foundational document that formally establishes the GRC program's authority, scope, and governance structure. It delineates roles such as risk owners, the steering committee, and the CISO, and defines how risk decisions are escalated and approved. This ensures accountability and alignment with strategic objectives before operational processes are designed.

Common controls are those that can be used by multiple systems and are typically inherited from the provider. Identifying them first prevents unnecessary duplication and ensures the control baseline accurately reflects shared responsibilities. This aligns with NIST SP 800-53 tailoring guidance to leverage inherited controls before selecting additional controls.

Shredding or incineration physically destroys the platter, so no residual magnetic state remains for laboratory recovery. This satisfies NIST SP 800-88's Purge/Destroy level for PII, exceeding cryptographic erase or degaussing where media reuse is not intended.

Interviews elicit qualitative evidence directly from personnel, capturing governance, risk and control practices that documentation alone cannot reveal. As a common assessment method, they satisfy the need to corroborate artefacts and observe how controls operate in practise, complementing techniques such as observation and document review.

A control may be marked Not Applicable if it addresses a technology or environment that the system does not use. For example, a control for physical access to a data center is not applicable to a cloud-only system with no physical servers. This is a valid tailoring decision based on the system's characteristics and is documented with justification.

NIST SP 800-37 Rev. 2 allows for multiple authorization boundaries when components are managed by different entities. The mainframe and COTS product are under the agency's direct control and can form one system. The cloud repository is a separate system with its own FedRAMP authorization. The agency should document the interconnection and inherit controls from the cloud provider's package, avoiding unnecessary duplication.

dm-crypt is the Linux kernel's native transparent disk-encryption subsystem, and LUKS provides the standard on-disk format and key management on top of it. Together they deliver full disk encryption for a Linux server, meeting the PCI-DSS requirement without third-party software.

FIPS 199 applies the high-water mark rule: the overall categorisation equals the highest impact value across confidentiality, integrity and availability. Integrity and availability are both Moderate, exceeding the Low confidentiality rating, so the system is categorised Moderate.

In an IaaS model, the organization is responsible for securing the virtual machines, applications, and data it deploys. These components are under the organization's control and should be included in the authorization boundary. The ISO must ensure that these components are assessed and authorized as part of the system, while inheriting controls from the cloud provider for the underlying infrastructure.

Applying uniform controls at every boundary node directly addresses the stem's constraint: a boundary spanning multiple geographic locations. Consistency across all nodes prevents location-specific gaps or weaker configurations that attackers could exploit, ensuring the same security posture regardless of where each node physically resides.

Examination involves reviewing configurations, documentation, and system settings, while testing involves exercising the control to observe its behavior. Together, they provide direct, objective evidence that encryption is implemented correctly and operates as intended. For a technical control, this combination is the most reliable because it validates both design and operational effectiveness, reducing the risk of false assurance from interviews alone.

NIST SP 800-53B baselines map MODERATE impact systems to a predefined set of controls, giving a standardised starting point before tailoring. This satisfies the stem's objective by ensuring consistent, impact-appropriate coverage rather than selecting controls ad hoc.

Chain of custody documentation records every transfer, handler and storage event for evidence, preserving an unbroken, auditable trail. This directly satisfies the integrity requirement by demonstrating that audit evidence has not been altered, substituted or tampered with between collection and presentation.

Under NIST SP 800-37 R2, the Assess step produces the Security Assessment Report, which the security assessor delivers to the Authorizing Official as evidence supporting the Authorize decision. The SAR therefore precedes authorisation, not the reverse.

Integrated GRC depends on funding, governance and executive attention that erode after initial rollout, especially when competing priorities emerge. Sustaining sponsorship across leadership changes and budget cycles is therefore a persistent challenge, not a one-off approval.

Examining the actual firewall rule sets, router configurations, and architecture diagrams provides independent, technical evidence of the implemented boundary protection controls. This aligns with the NIST SP 800-53A assessment methods of examine and test, allowing the assessor to confirm that the controls are in place and operating as intended rather than merely documented.

Ongoing security control assessments are a core component of continuous monitoring. They verify that controls remain effective over time and provide the authorizing official with the necessary data to maintain authorization. These assessments can be automated or manual and are defined in the continuous monitoring strategy. Without them, the authorizing official cannot rely on the system's security posture.

A Publisher Rule validates binaries against certificate issuer and product name, so only signed software from the organisation's certificate runs. This satisfies the stem's requirement that only organisation-signed binaries execute, unlike path or hash rules which do not enforce publisher identity.

Re-authorisation hinges on whether the change alters the security control baseline enough to invalidate the original authorisation decision. If controls are added, removed or weakened, the residual risk profile shifts, so the ISSO must reassess whether the existing authority to operate still holds.

Conditions attached to an ATO are unresolved weaknesses, so they belong on the Plan of Action and Milestones alongside open findings. Recording each condition with an owner, milestone date and status lets continuous monitoring evidence remediation progress and supports reauthorisation, satisfying the stem's requirement to manage conditions after authorisation.

The GRC analyst should perform a risk assessment to evaluate whether monthly scanning adequately addresses the system's risk. Factors include data sensitivity, threat landscape, and regulatory requirements. If the risk is acceptable, the change can be approved with documentation. This aligns with NIST RMF and continuous monitoring principles.

A security impact analysis is required whenever a change occurs that could affect security. It evaluates whether the change introduces new vulnerabilities, alters risk, or requires updates to controls. This analysis informs subsequent actions, such as reauthorization or control adjustments. It is the first step to ensure the change is properly evaluated before any remediation or acceptance.

Physical controls, such as tamper-evident seals, locked cabinets, and surveillance cameras, directly reduce the risk of card skimming and tampering by preventing unauthorized physical access to POS devices. These measures are essential for protecting payment card data and align with PCI DSS requirements for physical security.

Residual risk is the risk remaining after controls are applied. If effective controls are in place, the residual risk score will be lower than the inherent risk. This is the fundamental definition of residual risk in GRC. The analyst should explain that the controls reduce either the likelihood or impact, leading to a lower residual score.

Automating DSAR intake and tracking within the GRC platform ensures consistent handling, provides audit trails, and enforces regulatory deadlines through escalation alerts. This integration allows the privacy office to monitor status across jurisdictions, demonstrate compliance, and reduce manual errors. It aligns with GRC principles of centralized governance and control monitoring.

Configuration management and change control are essential for continuous monitoring because they ensure that system changes are authorized, documented, and assessed for security impact. Without them, the security posture can degrade unnoticed. NIST SP 800-137 identifies configuration management as a key component of continuous monitoring, enabling organizations to maintain an accurate inventory and baseline.

The RADIUS server authenticates the supplicant by validating credentials relayed from the authenticator, then returning an Accept or Reject decision. This satisfies 802.1X's requirement for a centralised authentication authority, since the authenticator itself only passes EAP messages and enforces port state, never verifying identity directly.

The SSP describes the system boundary, control implementation and inherited controls, forming the baseline against which NIST SP 800-53 compliance is assessed. Without it, assessors cannot determine which controls apply, so it is essential for verifying compliance.

The FedRAMP authorization package contains the CSP's system security plan (SSP), which documents control implementations, and the assessment results, which provide evidence of effectiveness. These are authoritative and specific to NIST SP 800-53 controls. Reviewing them allows the agency to accurately identify which controls are inherited, shared, or customer-implemented, ensuring proper control selection and documentation.

Pseudonymization replaces identifying information with artificial identifiers, reducing linkability to individuals. GDPR Article 25 explicitly cites pseudonymization as a technique for data protection by design and by default. It allows data to be processed for legitimate purposes while enhancing privacy, making it a direct implementation of the principle. It also supports other GDPR requirements like data minimization and security.

A SACM architecture provides the framework for automating data collection, analysis, and reporting. It defines the tools, protocols, and interfaces needed to integrate various security data sources. This enables efficient continuous monitoring. Without a SACM architecture, automation efforts may be fragmented and ineffective. The analyst should ensure this architecture is in place.

The Security Assessment Report is the formal record of assessment results, so an ineffective critical control must be captured there to trigger remediation and authorisation decisions. Documenting the finding satisfies the stem's requirement to record the deficiency as evidence for the AO.

Predictive KRIs are forward-looking and signal potential risk events before they occur, enabling proactive mitigation. Leading indicators, such as increases in employee turnover or system vulnerabilities, help executives anticipate issues. This aligns with the dashboard's purpose of providing early warning signals, allowing timely strategic adjustments.

External systems that interface with the system under consideration are not part of the authorization boundary but must be documented as external interfaces. The ISO should establish an interconnection security agreement (ISA) or similar document to define security responsibilities and data exchange requirements. This ensures that the interface is managed securely without expanding the boundary.

Contractual security requirements make compliance auditable and enforceable, letting the organisation specify controls, breach notification and right-to-audit clauses the contractor must meet. This establishes the binding obligation that governs the contractor's system, which informal assurances or trust alone cannot provide.

The Information System Owner holds operational accountability for the system and its security posture, so they formally approve the FIPS 199 categorization. Authorising officials and security officers contribute input, but the ISO signs off on the final impact level.