(ISC)2 Certified in Governance, Risk and Compliance (CGRC) (CGRC) (CGRC) — Questions 151–225

The primary purpose of a kickoff meeting is to align all parties on the assessment's scope, objectives, timeline, and responsibilities. It ensures that the auditor and the organization have a shared understanding of what will be assessed, how evidence will be collected, and who the points of contact are. This alignment reduces misunderstandings and helps the assessment proceed efficiently.

Continuous monitoring requires ongoing tracking and reporting of security control status to ensure they remain effective. This includes automated data feeds, manual reviews, and periodic reporting to Authorizing Officials. It enables timely identification of control failures and risk changes. This is a core component because it provides situational awareness and supports risk-based decisions throughout the system's lifecycle, as described in NIST SP 800-137.

The Authorizing Official holds risk acceptance authority, so their primary duty on a POA&M for a high-impact system is formally accepting the residual risk documented in it. That satisfies the stem's focus on the AO's decision role rather than remediation or milestone tracking.

Replacing the database server with a different OS version is a significant change that can affect the security posture and the validity of the ATO. NIST SP 800-37 requires reassessing affected controls and updating the security plan and authorization package. This proactive step ensures the AO's risk decision remains based on current information and preserves ongoing authorization.

In a limited-connectivity environment, controls that depend on continuous network access (e.g., real-time monitoring, online authentication) may not function. Tailoring involves identifying such controls and implementing compensating measures, such as local logging and periodic synchronization, to achieve the control objective. This is a valid scoping and tailoring action.

Least privilege means each account holds only the rights its role requires. Reviewing user account permissions and group assignments reveals excessive sudo, group or file access, directly satisfying the stem's requirement to verify least privilege on the Linux server.

The authorisation official owns risk acceptance, so approving tailoring decisions during Control Selection ensures the resulting control set matches the system's risk tolerance. This satisfies the stem's phase-specific constraint, distinguishing the AO's approval role from the assessor's testing and the system owner's implementation duties.

Marking a control Not Applicable removes it from the assessment baseline, so the system owner must document a technical justification explaining why the control does not apply to the system's environment, satisfying the SSP's requirement for defensible scoping decisions.

Tailoring involves assessing risk and determining if compensating controls can achieve the same security objective. A risk assessment provides the basis for accepting, mitigating, or transferring risk. This approach aligns with NIST guidance to tailor controls based on risk while maintaining an acceptable security posture.

Legacy systems frequently lack vendor support, rollback capability or redundancy, so applying patches risks outages that continuous monitoring depends upon. This satisfies the stem's legacy constraint: unsupported hardware and tightly coupled applications make patch deployment itself a stability hazard, complicating the monitoring cycle.

Continuous monitoring is the primary compliance activity during operations and maintenance. It involves ongoing assessment of controls, tracking of changes, and reporting to the Authorizing Official. This ensures that the system remains within its authorized risk tolerance and that any degradation in controls is addressed promptly. It is a requirement of the RMF and supports the ongoing validity of the ATO.

A workflow engine enforces the approval process through electronic signatures, assigns tasks to responsible parties, and maintains audit logs of all actions. This provides verifiable evidence that treatment plans were approved by authorized stakeholders and tracked to completion. It directly addresses the auditor's request for documented approval and progress tracking.

This approach directly addresses the duplication problem by creating a single set of internal controls mapped to multiple regulatory requirements. It allows evidence collected once to satisfy several frameworks, reducing effort and improving consistency. This is a core GRC practice known as control harmonization or common control mapping, and it aligns with the goal of streamlining compliance across multiple regulations.

The assessor or auditor performs the independent evaluation, examining evidence and testing controls against criteria. This role supplies the objective judgement the assessment process depends on, satisfying the requirement for a party who evaluates rather than operates the system.

The POA&M records identified weaknesses, remediation milestones and status, making it the vehicle for tracking security control changes arising from continuous monitoring. It satisfies the stem's requirement to manage control modifications, unlike authorisation packages or assessment reports, which capture point-in-time results rather than ongoing change tracking.

Reviewing the ISMS scope statement and security policy is a fundamental audit activity to verify that the organization has defined the boundaries of its ISMS and established a security policy. These documents are core requirements of ISO/IEC 27001 and provide evidence of the ISMS's foundation. This activity is appropriate for assessing the effectiveness of the ISMS.

When a service is shared across systems, it is often best treated as a common control provider. The organization can inherit the controls implemented by the service provider, documented in a customer responsibility matrix. This avoids redundant assessments and ensures that the controls protecting the shared database are properly evaluated and accepted by the Authorizing Official.

A POA&M must state when each weakness will be remediated, so the target completion date is a mandatory element. It satisfies the stem by providing the scheduled milestone against which remediation progress is tracked and closed.

An overlay is applied on top of an existing baseline, adding, tailoring or strengthening controls for a specific technology such as mobile devices. It never replaces the baseline; it extends it, so the baseline remains the foundation.

The Authorization Decision Document is the formal record where the AO grants the ATO and explicitly accepts the residual risk. It includes the authorization decision, any terms and conditions, and the expiration date. This document is the official artifact that signifies the AO's risk acceptance.

Ongoing assessment of security control effectiveness is a fundamental part of continuous monitoring. It involves automated and manual evaluations to determine if controls are implemented correctly and operating as intended. This activity provides the data needed to maintain situational awareness and supports risk-based decisions throughout the system lifecycle.

NIST 800-53 provides a catalogue of controls mapped across baselines, letting different teams, systems and business units apply the same structured control set. This yields repeatable, auditable security practise organisation-wide instead of fragmented, ad hoc measures.

Under the shared responsibility model, the organization's authorization boundary encompasses the components it configures and operates, such as its cloud account, data, and service configurations. The provider's underlying infrastructure is assessed by the provider and inherited by the organization, as described in NIST SP 800-37. This approach avoids duplicating assessments and maintains a clear separation of responsibilities.

Encryption of data in transit is a technical control because it is enforced by cryptographic mechanisms within systems and protocols, not by administrative policy or physical barriers. This mechanistic enforcement satisfies the stem's requirement for a technical security control.

A FedRAMP authorisation means an accredited assessor has already evaluated the CSP against NIST controls and issued a package. Your organisation can reuse that body of evidence, reducing the assessment effort needed for its own authorisation rather than starting from scratch.

A first-party audit is an internal audit conducted by the organization itself to assess its own controls, processes, or compliance. It is used for self-assessment and improvement, without external pressure. In this scenario, you are an internal auditor with full access, so it is a first-party audit. This type of audit helps identify gaps before external audits.

A network topology diagram maps every interconnection and external service endpoint, directly satisfying the SAP requirement to demonstrate complete interconnection inventory. Unlike prose lists, its visual structure exposes undocumented links and data flows, making omissions immediately apparent during assessment. This evidentiary completeness is what proves all system interconnections have been properly inventoried.

Full disk encryption (FDE) encrypts the entire volume, including the operating system, database files, and temporary files. If the physical disk is stolen, the data remains unreadable without the decryption key. FDE is specifically designed to mitigate risks associated with physical theft of storage media, aligning with GLBA requirements for protecting customer financial information.

The SSP describes the system's implemented controls and configuration. When a configuration changes during continuous monitoring, the SSP must be updated so its documented control implementation matches reality, satisfying the stem's requirement to revise documents affected by the change.

The official, version-controlled, and management-approved policy document is the authoritative source for the policy's content. It provides direct evidence of what the policy states and ensures that the assessor is reviewing the current, approved version. This is the most reliable evidence to verify compliance with framework requirements.

The frequency of vulnerability scanning should be based on risk, threat landscape, and compliance mandates. For systems handling CUI, NIST SP 800-171 and other frameworks may require specific scanning frequencies. Reducing from weekly to quarterly could significantly increase the window during which vulnerabilities remain undetected. The GRC analyst must assess whether the increased risk is acceptable and consistent with the organization's risk tolerance and any regulatory or contractual obligations.

NIST SP 800-60 provides the definitive guidance for mapping information types to FIPS 199 security categories. It supplies the impact-level assignments that organisations apply when categorising systems, making it the authoritative companion to FIPS 199 itself.

When a control is inherited, the system owner relies on the common control provider for its implementation. The most critical verification is that the control is actually implemented and effective, as the system's security depends on it. This ensures the inheritance claim is valid and the control meets the system's needs.

Each NIST 800-53 control identifier begins with a two-letter prefix denoting its family, such as AC for access control or AU for audit. The prefix therefore identifies family membership directly, satisfying the stem's requirement without needing the control title or enhancement fields.

When a control is inherited from another provider, the responsibility for assessing that control lies with the provider that implements it. The CSP's assessor should leverage the IaaS provider's existing FedRAMP authorization package, which includes assessment results. This avoids redundant testing and ensures that the control is evaluated by qualified assessors. The CSP must verify that the inherited control meets the required baseline and that the IaaS provider's authorization is current.

Quantitative risk assessment uses numerical data to estimate probabilities and financial impacts. Monte Carlo simulation models uncertainty by running thousands of iterations, producing a distribution of potential losses. Combined with ALE, which calculates expected annual loss, this method provides objective, monetary values that allow the CISO to compare risks and justify mitigation funding based on cost-benefit analysis.

Executive sponsorship supplies budget, authority and visible priority, which is what compels business units to adopt GRC processes rather than treat them as optional. It satisfies the stem's adoption requirement by converting the initiative from a compliance-side project into an enterprise mandate with escalation backing.

A chain of custody records who handled evidence, when, and why. This prevents tampering and ensures evidence remains admissible in legal or regulatory proceedings. In security assessments, maintaining an unbroken chain of custody is essential to demonstrate that evidence has not been altered. It provides a verifiable history that supports the integrity and authenticity of the evidence collected.

The documentation must explain how the compensating control actually reduces the identified risk, demonstrating that its mechanism provides equivalent protection to the original control. This justification is required so assessors can verify the control genuinely mitigates the risk rather than merely existing.

Information types processed, stored, or transmitted determine what data the system handles, which shapes where the boundary must be drawn to encompass all relevant processing. This satisfies the factor of scoping the system around its data flows.

The Security Assessment Report documents the assessor's findings against the security controls, including weaknesses and residual risk. It forms part of the Authorization Package alongside the SSP and POA&M, giving the authorising official the evidence needed to make a risk-based authorization decision.

Adding a control from a higher baseline to address a specific risk is a valid tailoring action known as supplementation. NIST SP 800-53 allows organizations to add controls beyond the baseline when justified by risk assessment. The rationale must be documented in the system security plan. This ensures the control set is risk-based and appropriate for the system's unique circumstances.

Applying security patches remediates known vulnerabilities in the operating system and installed software. This satisfies the hardening requirement to close exploitable flaws before attackers leverage published CVEs, keeping the server's codebase current against documented threats.

Tenable.io reports status from its own scan data, not the configuration management database. If no scan ran after the patch was deployed, the vulnerability remains 'open' in Tenable despite the CMDB marking it patched, explaining the mismatch between the two records.

A documented escalation workflow specifies who is notified, at what threshold, and within what timeframe when a boundary is breached. That provides the repeatable escalation path the director requires and closes the loop between measurement and action. Without this component, tolerance statements would be advisory only and breaches could go unaddressed.

Common controls are security measures inherited by multiple systems from a shared provider, such as an enterprise data centre's physical access controls. Identifying them during scoping avoids duplicating assessment effort, letting each system document inheritance rather than reimplementing the same control.

Repeat audit findings indicate control failures recurring across cycles. A reduction in these demonstrates that integrated GRC is remediating root causes and improving control effectiveness, a measurable outcome Boards understand, unlike activity or coverage metrics.

Mapping interconnections and data flow paths establishes which systems exchange data and through which boundaries, a prerequisite for authorisation boundary and contingency planning. Without this, the inventory cannot show dependency chains, so it satisfies the federal requirement for a complete, security-relevant system inventory.

Cryptographic erasure destroys the keys protecting the VM's encrypted volumes, rendering residual ciphertext unrecoverable even if remnants persist on shared cloud storage. This final step satisfies data privacy regulations requiring data to be irrecoverable after deletion.

NIST SP 800-137 identifies configuration management as a foundational element of continuous monitoring. It ensures that changes to hardware, software, and firmware are tracked and assessed for security impact. Without it, the organization cannot maintain an accurate baseline or determine whether changes introduce new vulnerabilities. The auditor should verify that configuration items are inventoried and changes are approved and documented.

A preventive control, such as input validation, segregation of duties, or authorization checks, stops errors or fraud before they affect the system. It provides reasonable assurance that transactions are authorized and recorded accurately by enforcing rules at the point of entry. This aligns with the CISO's request for assurance in the transaction process.

Workflow transitions allow for conditional routing based on specific metadata values.

The SSP's boundary description explicitly documents the authorisation boundary — the people, processes, and information systems comprising the system — which directly satisfies the RMF requirement for a defined System Boundary artefact used during categorisation and control scoping.

Operational controls are one of the three NIST SP 800-53 control categories, covering day-to-day processes and people-driven activities that keep security running, such as awareness training, contingency planning and incident response. This satisfies the stem's requirement to name the categories alongside management and technical.

The primary focus should be on metrics that accurately reflect control effectiveness and can be collected automatically for near real-time detection. This ensures that failures are identified promptly. Automation is key for continuous monitoring, but the metric must be directly tied to the control's ability to mitigate risk. This aligns with the goal of detecting control failures in near real-time.

The AO must review the POA&M, which documents how the organization will remediate or mitigate the identified weaknesses. This allows the AO to understand residual risk and make an informed authorization decision. The POA&M is a critical input to the authorization package, along with the SAR and System Security Plan (SSP), and must be considered before granting an authorization.

Following the Prepare for Assessment phase, NIST SP 800-53A directs assessors to conduct the assessment itself, gathering evidence and examining, interviewing and testing controls against the defined scope. This 'Assess Security Controls' step produces the findings later consolidated during reporting.

Control parameters are assignment statements that require organizations to define specific values, such as review frequency or timeout periods. Assigning a value based on risk tolerance and documenting it in the security plan ensures the control is tailored to the organization's needs and can be assessed objectively. This is a required step in the RMF and NIST SP 800-53 tailoring process.

Documenting tailoring decisions creates an auditable record explaining why specific controls were adjusted, added or removed, and how residual risk was accepted. This satisfies the requirement for traceable justification of risk management decisions throughout the authorisation process.

The SOC 2 report provides an independent assessment of the cloud provider's controls. Reviewing it helps identify which controls are already implemented and can be inherited by the organization. This is a key step in documenting common controls and reducing duplication of effort.

A system-specific control is scoped to one system and implemented by that system's owner, rather than inherited from a common control or organisation-wide programme. This distinguishes it from hybrid and common controls in the control allocation taxonomy.

The primary focus should be reassessing security controls because a boundary change can introduce new risks or invalidate existing controls. The SSP must document the updated control implementation and any new controls. This ensures that the system remains compliant and secure. Reassessment is critical to maintain an accurate authorization boundary.

The legacy application's incompatibility prevents patching, so the residual risk must be addressed another way. Compensating controls—such as network segmentation, enhanced monitoring or virtual patching—reduce that risk to an acceptable level, and documenting them provides the audit evidence needed to justify the accepted deviation.

This is correct because the threat landscape and vulnerability trends directly affect the risk of exploitation. If new threats are emerging or vulnerabilities are being actively exploited, more frequent scanning may be necessary. Reducing frequency could leave the system exposed to known threats.

The ISSO's role is to provide the AO with a thorough risk analysis. Before recommending authorization or denial, the ISSO should assess if compensating controls exist that effectively mitigate the risk. Presenting options, such as authorizing with conditions or requiring immediate remediation, allows the AO to make an informed risk-based decision. This approach balances security needs with mission requirements.

Persistent control failures must be escalated to the authorizing official, who is responsible for accepting risk and determining if the ATO remains valid. The analyst's role is to report and provide analysis, not to unilaterally accept risk. This action ensures that the appropriate authority evaluates the impact on the system's security posture and decides on remediation or risk acceptance.

NIST SP 800-53B provides low, moderate, and high baselines corresponding to impact levels. For a low-impact system, the low baseline is the appropriate starting point. It includes the minimum set of controls required for that impact level, which can then be tailored as needed.

Refinement adjusts the wording of a control statement so it precisely addresses the system's specific environment, making the control more exact and unambiguous. This differs from scoping, which removes controls entirely, and satisfies tailoring's goal of producing precise, system-specific control language.

Inclusion depends on whether the application depends on the database for operational integrity; if the system cannot function correctly without it, the database belongs inside the authorization boundary. This dependency, not ownership or age, determines the boundary decision.

TLS cipher suites are defined in the server's TLS configuration file, which the daemon reads at startup to restrict the negotiated cipher list. Editing this file directly satisfies the hardening requirement by disabling weak ciphers and permitting only secure ones for every incoming TLS handshake.

An inherited control's compliance depends entirely on the common control provider, so the critical verification is obtaining evidence that the provider actually implements and monitors the control. Without that evidence, the inheriting system cannot claim the control satisfies its own security requirement.

The SSH daemon reads its runtime behaviour from /etc/ssh/sshd_config, where the PermitRootLogin directive controls whether root may authenticate. Auditing this file directly satisfies the requirement to verify that root login is disabled, since ssh_config governs only outbound client connections and cannot affect server-side authentication policy.

The CRM service stores and processes PII, which is system data. Under FIPS 199 and NIST SP 800-37, any component that processes, stores, or transmits system data must be within the authorization boundary. Excluding it would leave a critical part of the system unassessed and could result in an incomplete risk picture. The boundary must include the CRM service to ensure its controls are evaluated and the PII is protected appropriately.

The Authorizing Official formally accepts the residual risk and signs the authorisation decision, granting the system authority to operate. This is the AO's defining accountability, distinct from assessors who test controls or system owners who implement them.

In cloud-native environments, the provider operates the underlying infrastructure, so organisations inherit fewer controls directly and must instead rely on third-party audit reports, such as SOC 2 attestations, as evidence that provider-side controls function effectively.