CGRC Practice Question: An organization is applying NIST SP 800-53 Rev
An organization is applying NIST SP 800-53 Rev. 5 controls to a cloud-based SaaS application. The authorization official requests that you perform 'supplementing' during the tailoring process. What is the correct action?
⚠ Common exam trap
CGRC often tests the vocabulary of the RMF tailoring process — candidates confuse supplementing (adding) with scoping (removing) or parameterization (adjusting), so reading the definition precisely is critical.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add additional controls to the baseline to address specific threat vectors.
In NIST SP 800-53 Rev. 5 tailoring, 'supplementing' means adding controls to the baseline to address specific threats, technologies, or organizational requirements not covered by the initial baseline. The authorization official's request to supplement therefore means adding additional controls (B).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Replace a control with a vendor-provided security feature.
Why it's wrong here
Replacing a control with a vendor feature is compensating-control substitution, not supplementing. Supplementing adds controls or enhancements to the baseline, which is correct when the organisation must strengthen coverage beyond what NIST SP 800-53 already prescribes.
- ✓
Add additional controls to the baseline to address specific threat vectors.
Why this is correct
Supplementing adds controls beyond the NIST SP 800-53 Rev. 5 baseline when the organisation's specific threat environment, mission, or technologies demand extra protection. Adding controls to counter identified threat vectors satisfies the authorization official's tailoring request, distinguishing supplementing from scoping or compensating control selection.
- ✗
Remove controls from the baseline that are technically infeasible.
Why it's wrong here
Removing controls addresses tailoring by scoping out inapplicable baseline items, which is the opposite of supplementing. Supplementing adds controls or control enhancements beyond the baseline to address organisation-specific risks, technologies, or environments. Deletion would be considered when a control genuinely does not apply to the system.
- ✗
Adjust the parameters of existing controls to lower operational impact.
Why it's wrong here
Parameter adjustment is tailoring, not supplementing; it changes values within existing controls. Supplementing adds controls or control enhancements beyond the baseline, which is correct when the organisation needs additional safeguards not present in the initial set.
About these practice questions
This CGRC question is part of Courseiva's 341-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
You might also like
Similar CGRC questions
- You are a security analyst at a hospital that must comply with HIPAA and NIST SP 800-53. You are selecting controls for…
- You are a security architect for a federal agency. You are selecting controls for a new high-impact system that processe…
- A security architect is selecting controls for a system that will be deployed in a virtualized environment. The architec…
- Which THREE actions are essential to correctly manage assignments in NIST 800-53 controls?
- You are selecting controls for a federal information system categorized as LOW impact. The system owner wants to use NIS…
Written and reviewed by Johnson Ajibi, MSc IT Security
Security Systems Architect · founder of Courseiva
Last reviewed September 2026 · checked against the official (ISC)² exam blueprint
This CGRC practice question is part of Courseiva's free (ISC)² certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CGRC exam.