CGRC Practice Question: If a control is determined to be 'system-specific', what does that mean?
If a control is determined to be 'system-specific', what does that mean?
⚠ Common exam trap
CGRC often tests the confusion between system-specific, common (inherited), and hybrid controls — candidates must remember that system-specific means implemented by the system owner for that system only, not shared or vendor-provided.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It is implemented by the system owner for that system only.
A system-specific control is one that is implemented by the system owner and applies only to that particular system, as opposed to common controls shared across the organization or hybrid controls that combine both. This designation is part of the NIST RMF control inheritance model, where controls are categorized as common, system-specific, or hybrid. The system owner bears responsibility for implementing and documenting system-specific controls in the system security plan.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It is a hybrid control.
Why it's wrong here
A hybrid control combines system-specific and common implementations; a system-specific control is implemented solely for that system, not a mix. The option tempts because both terms appear in the same control taxonomy, but hybrid describes shared inheritance, which is the opposite of system-specific.
- ✓
It is implemented by the system owner for that system only.
Why this is correct
A system-specific control is scoped to one system and implemented by that system's owner, rather than inherited from a common control or organisation-wide programme. This distinguishes it from hybrid and common controls in the control allocation taxonomy.
- ✗
It must be implemented by the vendor.
Why it's wrong here
System-specific controls are implemented by the organisation for its own system, not delegated to a vendor; vendor-implemented controls are common or hybrid. The option tempts because vendors often supply components, but the designation concerns where responsibility sits, not who builds the technology.
- ✗
It is inherited from the enterprise.
Why it's wrong here
Inherited controls come from the enterprise or a common provider, whereas system-specific controls are implemented by the organisation for that individual system. The option tempts because inheritance is a recognised control type, but it describes common controls, not the system-specific designation.
About these practice questions
This CGRC question is part of Courseiva's 341-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
You might also like
Similar CGRC questions
- An organization is selecting controls for a new information system. The system is categorized as low impact. According t…
- During tailoring, what is the 'Refinement' process?
- You are assessing a system. You find a control that is marked as 'Inherited'. What is the most critical item to verify?
- You are selecting controls for a high-impact system that processes sensitive law enforcement data. The system uses a com…
- You are tailoring controls for a system that does not process PII. Which action should you take regarding the Privacy (P…
Written and reviewed by Johnson Ajibi, MSc IT Security
Security Systems Architect · founder of Courseiva
Last reviewed September 2026 · checked against the official (ISC)² exam blueprint
This CGRC practice question is part of Courseiva's free (ISC)² certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CGRC exam.