(ISC)2 Certified in Governance, Risk and Compliance (CGRC) (CGRC) (CGRC) — Questions 226–300

Interviewing incident response team members helps assess their understanding of their roles, responsibilities, and the procedures they must follow. It also evaluates the effectiveness of training and communication. This is a critical component of assessing incident response capability because even a well-documented plan can fail if the team is not prepared. Interviews provide direct evidence of readiness.

An inbound rule permitting TCP port 443 from 0.0.0.0/0 satisfies the requirement to accept HTTPS from any internet source. Security groups are stateful and default-deny all other inbound traffic, so no explicit deny rule is needed; every non-443 packet is dropped automatically.

Patch management closes known software vulnerabilities that malware exploits for initial execution and privilege escalation. By remediating these flaws across endpoints on a defined schedule, it removes the attack surface malware depends on, directly satisfying the endpoint hardening requirement.

FIPS 199 categorisation assigns the confidentiality, integrity and availability impact levels that drive every subsequent RMF step, so the completed Security Categorization document is the mandatory artefact that formally closes categorisation and authorises the process to begin.

These indicators combine risk treatment coverage with remediation timeliness, directly reflecting whether the program is reducing exposure and closing gaps over time. Tracking the percentage of high risks with approved treatment plans shows governance discipline, while the trend in overdue remediation items reveals whether execution is improving. Together they provide outcome-oriented evidence of program maturity and effectiveness.

S3 Block Public Access overrides bucket policies and ACLs that would otherwise grant public access, acting as the primary account- and bucket-level guardrail. It directly satisfies the requirement to prevent public exposure of the bucket holding sensitive PII.

Network segmentation isolates the affected system into a separate zone, restricting lateral movement and exposure. This compensates where a required control cannot be implemented exactly, reducing risk through containment rather than the original control mechanism.

The System Security Plan documents the security controls selected and implemented for a system based on its risk assessment, describing control implementation and responsibilities. It is the authoritative artefact linking assessed risk to the specific controls the organisation commits to operating.

This is correct because the SSP must accurately describe the system's security controls. If the implementation is effective but differs from the documented description, the SSP should be updated to maintain accuracy. This ensures that future assessments and audits reflect the true state of the system.

A pre-assessment meeting aligns both parties before formal auditing begins, setting expectations and coordinating logistics. This satisfies the stem's requirement by establishing scope, timelines, evidence requirements and points of contact upfront, reducing misunderstandings during fieldwork. It is preparatory rather than evaluative, so no control testing or compliance determination occurs at this stage.

A self-assessment is conducted internally by the organisation's own staff to evaluate control effectiveness, without an external auditor or regulator driving it. This matches the stem's requirement for an internal department review performed free of external pressure.

The Authorization Decision Document records the authorising official's formal approval for a system to operate, conveying accepted risk and defining terms. It is the artefact that grants authority to operate, distinct from the security plan or assessment report.

The continuous monitoring strategy defines the approach, metrics, and reporting for tracking control effectiveness. Associated reports show actual data over time. Reviewing these artifacts directly verifies whether the program is effectively monitoring control changes. This aligns with NIST SP 800-137, which requires a documented strategy and ongoing reporting to support risk management.

The Authorization Boundary Diagram is a visual representation that explicitly defines the system boundary, showing components, interfaces, and data flows. It is a key artifact used by the Authorizing Official to understand what is included in the assessment. This diagram helps ensure that all necessary components are assessed and that external connections are clearly identified.

When the system owner disputes an assessor's finding, the ISSO should first work with the SCA to resolve the discrepancy by presenting additional evidence. This may lead to a reassessment and potentially overturn the finding, ensuring the assessment report is accurate before it goes to the AO.

The Entity or Organisation Manager module maintains the hierarchical business-unit and department structure that risk records reference, satisfying the stem's requirement to document organisational structure for risk assignment. Other GRC components handle risk registers, controls or assessments, but none model the reporting hierarchy itself, so this module is the one that assigns risks to the correct organisational node.

A control overlay is a set of additional controls or control enhancements applied to a baseline to address specific requirements, such as those for high-impact systems or unique technologies. Using an overlay allows you to augment the CSP's Moderate baseline with the needed controls while maintaining a structured approach. This is the correct first step to address the gap.

The Executive Dashboard and Reporting module aggregates risk data into real-time visualisations and reports for leadership. It satisfies the stem's requirement for accurate, current risk posture information by consolidating metrics from across the GRC platform into a single executive-facing view.

Tailoring permits removal of controls that are not applicable, but the decision must be documented with justification to preserve the audit trail. Since the system processes no PII, the Privacy family can be excluded, provided the rationale is recorded in the tailoring documentation.

The SSP documents the implemented controls and their descriptions, while the SAR records the assessor's findings on whether those controls operate effectively. The SAR therefore evaluates the effectiveness of the controls described in the SSP, establishing the assessment-to-plan relationship the question asks about.

The immediate priority is to eliminate the unauthorized exposure. Removing or restricting the rule aligns the actual configuration with the approved security posture. Afterwards, the SSP must be updated to reflect reality, and a POA&M entry should capture the root cause and corrective actions. This approach restores compliance and addresses the deviation through proper documentation and follow-up.

Automated validation rules reject malformed, out-of-range or inconsistent entries at the point of capture, preventing corrupt records from entering the GRC system of record. This enforces data accuracy and completeness, directly satisfying the integrity constraint by stopping bad data before it propagates.

Storing the BitLocker recovery key in Active Directory ties it to the computer object, letting authorised administrators retrieve it centrally under existing access controls. This satisfies the requirement for secure, recoverable storage rather than local or user-held copies.

On-premises servers that are owned and managed by the agency and process CUI are clearly within the authorization boundary. The agency is responsible for implementing and assessing controls on these servers. Including them ensures that the security assessment covers all components under the agency's control that handle sensitive data.

The memo must identify precisely what risk is being accepted, including its source, affected assets and likelihood. Without a clear description, the acceptance is meaningless, so this satisfies the requirement to document the specific identified risk being formally tolerated.

The CRM explicitly lists each security control and indicates whether the CSP, the agency, or both are responsible for implementing it. This allows the agency to focus its assessment on the controls it owns and inherit the CSP's assessment for the rest. The CRM is essential for scoping the agency's assessment effort.

NIST SP 800-37 Rev. 2 and SP 800-53A permit leveraging assessment results from common controls if they are current, sufficient, and applicable. The Assessor should review the shared report against the system's assurance needs, then document the inheritance in the SSP. This approach avoids redundant work while ensuring the control is appropriately evaluated. It supports an efficient and accurate authorization decision.

Rules of Engagement define the authorised scope, boundaries, timing, and constraints of an assessment, forming the primary agreement between assessor and target organisation. They establish what systems may be tested, satisfying the requirement to outline audit scope before work begins.

The SAP defines the scope, objectives, timeline, and responsibilities for the assessment. It is the foundational document that ensures all parties agree on what will be assessed and how. Before any testing or evidence collection begins, the SAP must be approved to prevent scope creep and misunderstandings. It directly addresses the need to establish a shared understanding of the assessment boundaries.

The SSP is the primary document that describes the system, its boundary, and how security controls are implemented. Continuous monitoring findings, such as new vulnerabilities or configuration changes, must be reflected in the SSP to keep it accurate. An outdated SSP undermines the authorization package and can lead to incorrect risk decisions by the AO.

The continuous monitoring plan (CMP) is the document that outlines the organization's strategy for ongoing monitoring of security controls, including the frequency of assessments, the types of reports, and the roles and responsibilities. Under FedRAMP, the CMP is a required deliverable that describes how the cloud service provider will maintain continuous monitoring. Reviewing the CMP provides the necessary information to verify compliance.

An automated workflow trigger keyed to vendor tier and date enforces the annual due diligence requirement without manual tracking. When the tier equals Critical and the review date elapses, the workflow initiates reassessment, satisfying the mandated recurring control.

A prebuilt data connector or API integration module maps the CSPM tool's native output to the GRC platform's control and risk objects, automating ingestion. This avoids bespoke scripting and manual uploads, making it the most efficient way to feed continuous monitoring data.

Under the shared responsibility model the cloud service provider secures the underlying infrastructure it operates — physical facilities, hypervisors, host networking and managed service internals — while the customer owns their data, identities and configurations. Compliance maintenance is therefore split, with the CSP accountable for its layer.

NIST SP 800-53B supplies the actual Low, Moderate and High baseline control selections, derived from the SP 800-53 catalogue, that federal information systems must implement. It satisfies the stem's requirement for a document defining those three baselines, whereas SP 800-53 itself provides the broader control catalogue without baseline allocation.

A High risk finding requires the system owner to record the weakness in the POA&M with milestones, resources and a remediation schedule, satisfying the stem's requirement for a plan of action. Simply accepting or ignoring the finding leaves the risk unmanaged and unauthorised.

If the identity provider is omitted from the boundary, its controls may not be included in the assessment, creating a gap in authentication security. Even if it is an external service, the system relies on it, so its controls must be either assessed or inherited. The omission could lead to unmitigated risks that affect the entire system's authorization.

The ISSO should first document the finding and work with the CSP to verify compliance or find a compliant alternative. Even if the module is CSP-managed, the system owner remains accountable for ensuring all controls meet requirements. The POA&M tracks remediation, and collaboration with the CSP is necessary to resolve the issue without duplicating effort.

The system and authorisation boundary must be defined first because it determines which components, interfaces and data flows fall within assessment scope. Without it, the SAP cannot ensure adequate coverage of the controls inherited and implemented.

Under ongoing authorization, the authorizing official relies on continuous monitoring data to maintain the authorization. When there are no significant changes and controls remain effective, updating the package and continuing ongoing authorization is appropriate. This avoids unnecessary reauthorization while ensuring the authorization remains valid through continuous oversight.

A formal risk acceptance memo or letter is the appropriate document for a system owner to accept a risk. It typically includes the specific risk, its impact, the rationale for acceptance, and the period of acceptance. The system owner's signature on this document provides the necessary authorization to operate with the known risk. This document is then retained as part of the system's authorization package.

Ongoing security control assessments are a fundamental part of continuous monitoring. They involve evaluating controls at a frequency defined by the organization to ensure they remain effective over time. This includes automated and manual assessments. The results feed into the risk determination and help maintain an up-to-date understanding of the system's security posture, enabling timely remediation of deficiencies.

When a control is partially implemented, it is considered a finding. The SAR documents assessment results, and the POA&M tracks remediation activities. This aligns with RMF Step 6 (Monitor) and the requirement to maintain ongoing authorization. The ISSO must ensure the finding is recorded and a plan exists to address the deficiency, which may include milestones and resources.

A charter derives its force from an executive mandate. Without documented sponsorship from top leadership, the GRC function can only advise; it cannot compel business units outside its reporting line to adopt controls or remediate findings. This scenario requires cross-functional enforcement authority, which only an executive-granted mandate supplies.

Partitioning or scoping data by region physically constrains where records reside and who may query them, directly satisfying the residency constraint. Access is bounded by the regional boundary rather than by role alone, so cross-border reads cannot occur.

FedRAMP allows organizations to inherit controls from an authorized CSP, reducing the scope of their own assessment. The organization must still assess controls that are not covered by the CSP's authorization, such as those specific to the system or implemented by the organization. This approach leverages the CSP's authorization while ensuring full coverage.

The authorising official must judge whether residual risk is tolerable, which depends on the potential impact on the organisation's mission. Without that, the acceptance decision lacks the business context needed to weigh the unpatched vulnerability.

VMRC establishes an encrypted TLS session to the ESXi host, protecting console keystrokes and screen data from interception on the management network. This satisfies the requirement to secure virtual machine consoles against eavesdropping, unlike unencrypted browser-based consoles or plain VNC.

An Evidence Lock or Retention Policy prevents modification or deletion of the stored record for the defined period, preserving it in an immutable state. This directly enforces the three-year immutability constraint the GRC programme requires for assessment evidence.

Assignment parameters are deliberately left blank in NIST 800-53 so the organisation fills them in. As system owner, you select the frequency value that matches your organisational policy, risk tolerance and operational context, then document it in the control implementation statement.

The SSP documents the provider's implemented controls, and the Authorization Package contains the assessor's evidence and authorisation decision. Together they provide the primary artefact demonstrating which security controls exist and have been independently evaluated for the cloud service.

Tailoring requires that any control deemed not applicable be removed from the baseline and the rationale recorded. The SSP is the authoritative document capturing the tailored control set, so recording both the removal and its justification there preserves the audit trail and satisfies the traceability constraint.

Automatic expiration prevents exceptions from becoming permanent. Notifying the requester prompts a re-evaluation of the risk and ensures that the exception is still necessary. This supports regular review and reduces the risk of stale exceptions that no longer have a valid business justification, which is critical for maintaining a strong control environment.

Leveraging a CSP's FedRAMP authorization allows the organization to inherit the controls that the CSP implements and documents. These inherited controls are recorded in the SSP, reducing the assessment burden. The organization remains responsible for controls outside the CSP's boundary and for ensuring the CSP's authorization covers the required impact level. This approach is efficient and promotes reciprocity.

The authorization boundary is drawn around components the organisation owns and controls, since shared external partner systems fall outside its direct authority. Ownership and control therefore determine what the boundary legitimately encompasses when data is shared externally.

TLS 1.3 encrypts the communication channel and includes message authentication codes to detect tampering, directly addressing the HIPAA requirement to guard against unauthorized access to ePHI during transmission. It also supports perfect forward secrecy, which limits the impact of key compromise. This makes it a suitable technical control for transmission security.

A real-time dashboard with automated alerts directly demonstrates continuous visibility into the security posture. This enables the authorizing official to make timely, risk-based decisions and supports the concept of ongoing authorization. It aligns with NIST SP 800-137's emphasis on automation and near-real-time monitoring to maintain an acceptable risk level.

Conditional Access evaluates sign-in signals and enforces MFA at authentication time, covering all modern protocols and clients. This satisfies the stem's demand for the most recommended modern authentication control, unlike per-user MFA, which is legacy and cannot apply granular, signal-based conditions.

Clearly defined roles and responsibilities distribute compliance accountability across business units and management, reinforcing that compliance is not solely the GRC team's job. This element ensures that each function understands its obligations and how it contributes to the program. It is the structural mechanism that translates the principle of shared responsibility into actionable expectations across the organization.

Monitoring security alerts and advisories is essential to identify new threats and vulnerabilities that may affect the system. NIST SP 800-137 includes this as part of the 'monitor' step. By staying informed, the ISSO can proactively address emerging risks and adjust controls, ensuring the system remains compliant with its security requirements.

This is a leading indicator because unpatched vulnerabilities are a known precursor to breaches. Monitoring the percentage of critical systems with overdue patches provides early warning of increasing exposure. It is predictive and actionable, allowing the organization to remediate before an incident occurs, directly aligning with the CISO's request for forward-looking KRIs.

The correct action is to treat the non-compliant encryption as a finding. The system owner must develop a POA&M to remediate it by implementing FIPS 140-2 validated cryptography. This aligns with the RMF process of documenting findings and planning remediation. Until remediation, the risk must be assessed and potentially accepted by the AO.

NIST SP 800-37 R2 continuous monitoring requires that significant changes be assessed before authorisation continues. A security impact analysis determines whether the software update alters the system's risk posture, controls, or authorisation boundary, informing whether reauthorisation or control updates are needed.

Tailoring removes controls that cannot be implemented because the system lacks the relevant technology, such as a mainframe-only control in a cloud-native environment. This is a scoping decision documented in the system security plan, satisfying the stem's requirement for a valid, defensible reason to tailor the NIST 800-53 baseline.

Adding a new interconnection expands the system boundary and introduces new risks that were not assessed in the original authorization. NIST SP 800-37 requires that significant changes, including boundary changes and new interconnections, be assessed through a security impact analysis. If the change is significant, the Authorizing Official must decide whether to reauthorize. This event clearly alters the risk profile and requires a reauthorization decision.

General Counsel sits on a GRC Steering Committee because legal exposure, contractual obligations and regulatory interpretation shape enterprise risk appetite. Their participation ensures governance decisions align with statutory duties, providing the legal perspective the committee needs alongside risk and security leadership.

Automated security regression testing in the CI/CD pipeline re-verifies controls after each release, satisfying the need to keep the baseline effective despite frequent DevOps changes. It detects control drift continuously rather than at periodic authorisation reviews.

Recording why each firewall rule exists lets reviewers identify obsolete, redundant, or overly permissive entries during audits and change control. This documented justification supports periodic rule recertification, satisfying the stem's requirement for a recommended firewall rule management practise.

System criticality and environmental change rate directly determine monitoring cadence under NIST continuous monitoring guidance, since high-impact systems with frequent configuration or threat changes require shorter assessment intervals. This satisfies the stem's high-impact constraint by scaling frequency to risk rather than applying a fixed schedule.

Documenting procedures, evidence, and findings in a SAR provides a transparent record that supports repeatability and auditability. The SAR allows others to understand how conclusions were reached and provides a basis for remediation and continuous monitoring. It also serves as evidence for the Authorizing Official and supports reciprocity across the organization.

The system security plan is the foundational document that describes the system boundary, its components, the data flows, and how security controls are implemented. Requesting it first allows the assessor to understand the scope and design of the system, which is essential for planning the assessment. Without the SSP, the assessor would lack the context needed to select appropriate assessment procedures.

Naming a specific owner and holding them accountable satisfies the governance constraint that every policy has enforceable responsibility. Without assigned ownership, review cycles, exceptions and updates stall, so this element ensures the policy remains maintained rather than orphaned.

A dedicated Incident Response Team provides the standing capability to detect, triage, and contain security events. Without assigned personnel, response controls cannot be executed, so the IRT is a foundational element of the incident response control set.

The database is part of the system because it stores and processes data. Even though it resides in a separate VPC, it is managed by the same organization and supports the system's functionality. The ISO should include all three components and document the interconnections and security controls. This ensures a complete assessment and accurate categorization. The boundary should reflect the logical system, not just physical proximity.

Documenting the identity provider as an external interface is correct because it is outside the system's direct control but is essential for authentication. NIST SP 800-37 requires that external interfaces and dependencies be described, including trust relationships and inherited controls. This ensures that the system's security posture accounts for the external service's risks and that any reliance on its controls is justified.