CGRC Practice Question: During tailoring, what is the 'Refinement' process?
During tailoring, what is the 'Refinement' process?
⚠ Common exam trap
CGRC often tests the distinction between the three tailoring activities — candidates confuse refinement (adjusting wording) with supplementation (adding controls) or scoping (removing controls), and pick 'adding new controls' because it sounds like tailoring.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Adjusting the control statement to make it more precise.
Refinement in the RMF tailoring process (NIST SP 800-37 / SP 800-53) is the step where control statements are adjusted — adding specificity, clarifying language, or scoping the control to the system's particular environment — so the control is precise and implementable. It does not change the control's intent or the system's impact level; it makes the wording actionable for the specific system. This is distinct from scoping (removing controls not applicable) and supplementation (adding controls beyond the baseline).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Changing the impact level of the system.
Why it's wrong here
Refinement in tailoring adjusts control baselines and scoping decisions, not the system's assigned impact level, which is set during categorisation under FIPS 199. It is tempting because refinement does tune controls to context, but changing impact level alters the categorisation itself, a separate step preceding selection.
- ✗
Removing controls that are too expensive.
Why it's wrong here
Refinement adjusts control applicability and implementation detail; cost alone is not a tailoring criterion, and removal must follow scoping or applicability logic. It is tempting because tailoring does reduce the baseline, and removing controls is correct when they are genuinely not applicable to the system.
- ✓
Adjusting the control statement to make it more precise.
Why this is correct
Refinement adjusts the wording of a control statement so it precisely addresses the system's specific environment, making the control more exact and unambiguous. This differs from scoping, which removes controls entirely, and satisfies tailoring's goal of producing precise, system-specific control language.
- ✗
Adding new controls to the baseline.
Why it's wrong here
Refinement scopes and tailors existing controls to the system's environment, not add controls absent from the baseline. It is tempting because tailoring does change baseline content, and adding controls is correct when the baseline genuinely omits a needed safeguard, which is supplementation rather than refinement.
About these practice questions
Courseiva writes every CGRC question from scratch — 341 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
You might also like
Similar CGRC questions
- You are assessing a system. You find a control that is marked as 'Inherited'. What is the most critical item to verify?
- You are selecting controls for a high-impact system that processes sensitive law enforcement data. The system uses a com…
- You are tailoring controls for a system that does not process PII. Which action should you take regarding the Privacy (P…
- Which document defines the security control baselines (Low, Moderate, High) for federal information systems?
- A control in the NIST 800-53 catalog has a parameter that reads: '[Assignment: organization-defined frequency]'. What is…
Written and reviewed by Johnson Ajibi, MSc IT Security
Security Systems Architect · founder of Courseiva
Last reviewed September 2026 · checked against the official (ISC)² exam blueprint
This CGRC practice question is part of Courseiva's free (ISC)² certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CGRC exam.