(ISC)2 Certified in Governance, Risk and Compliance (CGRC) (CGRC) (CGRC) — Questions 301–341

Continuous monitoring demands a closed-loop mechanism: detection alone leaves risk unaddressed. A formal vulnerability tracking and remediation process supplies the response capability, ensuring identified weaknesses are logged, assigned, and resolved within defined timeframes, which satisfies the program's requirement for ongoing risk reduction rather than periodic snapshot assessment.

Code signing uses a cryptographic signature to verify the integrity and origin of build artifacts. Before deployment, the pipeline verifies the signature against a trusted certificate, ensuring that only approved and unaltered code reaches production. This directly prevents tampering and unauthorized changes, meeting the requirement for integrity in the CI/CD pipeline.

Cameras are a physical security control because they monitor and record the physical environment, deterring and detecting intrusions at a site. They satisfy the stem's requirement for a physical, rather than logical or administrative, safeguard.

A security baseline documents the minimum mandatory configuration settings for systems, translating high-level controls into specific, repeatable implementation requirements. It standardises deployment across the organisation, satisfying the need for consistent control implementation, unlike policies or procedures that state intent without configuration detail.

A security impact analysis is the prescribed first step when a configuration change potentially affects security controls. Here, the logging service failure could undermine audit and accountability controls, so the analyst must assess the impact before deciding on remediation or reauthorization. This aligns with continuous monitoring and change management requirements under NIST SP 800-37 and maintains the ATO's validity.

Meeting minutes are the formal record that a governing body reviewed and approved the risk appetite and tolerance levels. They provide dated, auditable evidence of governance oversight. The scenario specifically asks for evidence that the governing body approved the appetite within the last twelve months, which the minutes directly demonstrate. This is the standard artifact auditors expect for governance approval.

Legacy hardware prevents the baseline NIST 800-53 control from being met, so an alternative control is applied to reduce the same risk to an acceptable level. That substitution, driven by the implementation constraint, is precisely what defines a compensating control.

Separation of duties splits privileged DBA tasks across multiple accounts, so no single compromised credential can both alter data and conceal the change. This administrative control directly limits the blast radius of one hijacked DBA account.

Documenting the physically secured enclave as a compensating control directly addresses the MFA deficiency, since the SAR must record how residual risk is mitigated when a required control is absent. Assessing its effectiveness confirms the enclave genuinely constrains access, satisfying the compliance determination requirement to justify accepting the legacy application's deviation.

When a critical control fails, the GRC analyst must ensure the system owner and ISSO are informed so they can assess the risk and take action. A security impact analysis determines the severity and potential impact on the system's authorization. This aligns with continuous monitoring and incident response processes. Immediate notification enables rapid remediation and informed decision-making by the Authorizing Official if the risk is significant.

The SSP documents the implemented controls, their scope, and any tailoring statements, such as scoping guidance or parameter values. Reviewing it first ensures that assessment procedures are aligned with what is actually implemented and avoids assessing controls that are not applicable or are inherited from a common provider. This step is critical for scoping the assessment accurately.

Applying a status filter scoped to 'Verified' restricts the widget's dataset so it renders only assessments whose completion status equals Verified. The dashboard therefore refreshes solely when that condition is met, satisfying the requirement without altering the underlying assessment records or their workflow.

Full-disk encryption protects data at rest by encrypting the entire storage volume, and storing the key in a hardware-backed secure enclave prevents extraction. Remote attestation allows the server to verify the device's integrity state, detecting rooting or jailbreaking. This combination directly satisfies both confidentiality and integrity verification requirements for the mobile banking scenario.

Communicating findings to stakeholders fulfils the Assessment Reporting phase's core purpose: translating raw assessment results into decision-ready information. This satisfies the stem's requirement for the phase's primary goal, since reporting exists to inform risk decisions, authorisation judgements and remediation priorities — not to perform testing, which belongs to earlier assessment phases.

OVAL defines an XML-based language for expressing system configuration checks, enabling SCAP tools to assess and report on a target's state. It satisfies the stem's configuration-state assessment purpose, distinct from CVE identifiers or CVSS scoring.

Configuration Items define the registry key settings to detect and remediate, then deploy them through a baseline to every workstation. This directly satisfies the requirement to verify specific registry keys across all workstations, since CIs are the compliance-rule building block MECM evaluates.

Availability is one of the two security objectives FIPS 199 requires you to assess, alongside integrity and confidentiality. The standard directs agencies to evaluate the potential impact on availability — ensuring timely and reliable access to information — when categorising an information system's security level.

Sanitisation removes or destroys residual data on the storage media using an approved method such as cryptographic erase or degaussing, ensuring sensitive information cannot be recovered after the hardware leaves the organisation's control. This satisfies the stem's constraint of protecting stored sensitive data before disposal, which no other decommissioning step addresses.

A Category Filter narrows the heat map dataset to risks tagged 'Cybersecurity', satisfying the executive's requirement to exclude all other risk categories. Saving that filtered state as a Saved View lets the dashboard widget persist the scoped display for repeat access, avoiding manual re-filtering each session.

Automated technical controls must be verified through testing, not interviews, which only capture assertions. Requesting reassessment using the Test method obtains objective evidence that the control operates as specified, satisfying the assessment procedure's required method.

Routing production access through a jump server with MFA enforces a controlled intermediary, so the developer never connects directly to the server. MFA satisfies the stem's highest-security constraint by adding a second authentication factor, while the jump host centralises session logging and restricts the production server's network exposure.

Documenting the weakness in a Plan of Action and Milestones satisfies FedRAMP's continuous monitoring requirement: POA&Ms formally record each identified control deficiency, assign remediation milestones, and track progress to closure. This is the mandatory mechanism auditors expect when a required control is unmet, ensuring the finding is tracked rather than left unresolved.

The POA&M is the central document for tracking known security weaknesses that require remediation over time. It records the weakness, planned corrective actions, milestones, and responsible parties. This provides the AO with ongoing visibility into the risk posture and ensures that unresolved findings are managed rather than forgotten. Immediate fixes do not need POA&M entries once verified.

The Control Catalog enumerates the full set of NIST SP 800-53 controls and their enhancements, giving organisations a baseline reference from which to select and tailor controls for hybrid cloud systems, rather than prescribing implementation or assessment procedures.

ISO/IEC 27007 provides guidance specifically for auditing information security management systems against ISO/IEC 27001, covering audit programme management, competence, and evidence gathering. It satisfies the stem's requirement for the framework governing how information security audits are conducted.

This is correct because the centralized identity management system and enterprise policy provide access control functions that can be inherited by the payroll system. Documenting them as common controls avoids duplication and accurately reflects the shared responsibility. The system security plan should reference the common control provider and describe how the controls meet the system's needs, which is efficient and compliant with NIST SP 800-53 practices.

Assignment statements in NIST 800-53 controls mark organisation-defined values, letting each organisation insert its own specifics such as frequency, roles or thresholds. They parameterise the control so it can be tailored to the organisation's risk context.

A formal change management process with approval workflows and segregation of duties ensures that changes are authorized, tested, and documented. It prevents unauthorized modifications and provides an audit trail. This control directly meets the requirement by enforcing a structured, accountable change lifecycle.

The CMVP validation certificate is issued under the Cryptographic Module Validation Program, the accredited body that tests cryptographic modules against FIPS 140-3 requirements. It directly evidences independent third-party validation, satisfying the stem's demand for the strongest compliance proof rather than vendor self-assertion.

A defined review cycle with assigned owners ensures documents are periodically revalidated for accuracy, relevance, and alignment with current regulations and business practices. Without ownership and a cadence, documents become stale and lose authority. This activity directly supports the goal of keeping documented information current and appropriately authorized, making it essential to the process described.

The Security Control Assessor evaluates implemented controls against defined criteria, testing whether they operate as intended and documenting residual risk. This assessment produces the evidence authorising officials use to decide whether a system may be granted an authority to operate.

Examining audit logs and account management records provides objective evidence of whether temporary privileges were revoked as required. This method directly verifies the control's operation by checking actual system activity against policy. It is the most reliable way to determine if the account management control is effective, as it reveals discrepancies between intended and actual behavior without relying on subjective statements.

Ongoing authorization requires continuous monitoring, so periodically reviewing security assessment results confirms controls remain effective after the initial authority to operate. This recurring review satisfies the continuous-monitoring constraint rather than relying on a one-off assessment.

A user permission or access control report aggregates each principal's assigned rights across compliance evidence, showing precisely who holds Write access. This satisfies the audit requirement for an overview by permission level rather than activity or change history.

NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations, provides the comprehensive catalog of controls used in the RMF process. It is the authoritative source for selecting controls based on security categorization. Under FISMA, agencies must use this catalog to implement controls, making it the correct reference for the control implementation phase.

When a control is not applicable, it should be marked as such with a clear rationale. This documentation is essential for transparency and for assessors to understand the decision. NIST guidance requires that tailoring decisions, including Not Applicable determinations, be documented in the security plan.

Excluding known safe processes and signers stops the EDR engine from flagging trusted, benign activity, directly reducing false positives. Visibility is preserved because all other process and file behaviour remains monitored, satisfying the stem's balance of low noise and continued detection.

The auditor should request evidence that demonstrates the compensating controls are implemented and effective. This could include configuration settings, logs, or test results. By evaluating the evidence, the auditor can determine whether the risk is adequately mitigated or if the finding should stand. This collaborative approach respects the system owner's input while maintaining objectivity and evidence-based conclusions.

A RACI matrix clarifies who is Responsible, Accountable, Consulted, and Informed for each GRC activity. It ensures that stakeholders understand their roles and helps prevent gaps or overlaps in responsibilities. This is a foundational governance artifact that communicates expectations and supports accountability across the organization.

Role-based access control (RBAC) restricts system access to authorized personnel based on their role, satisfying the requirement for access control. Audit logging records user activities, providing accountability and tracking. Together, they meet the CJIS requirements for access control and audit, ensuring only authorized access and activity tracking.

Mapping regulatory requirements to internal controls lets one control satisfy multiple frameworks, so evidence gathered once can be reused across audits. This directly reduces redundant testing effort, which is the primary benefit GRC platforms deliver through control-to-requirement mapping.