CGRC Practice Question: The primary role of the authorization official (AO) during the Control Selection phase?
What is the primary role of the authorization official (AO) during the Control Selection phase?
⚠ Common exam trap
CGRC often tests role confusion in the RMF — candidates must distinguish governance roles (AO, system owner, CISO) from technical roles (assessors, engineers), and the AO is consistently the approver, not the doer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To approve the tailoring decisions.
During the Control Selection phase, the Authorizing Official (AO) is responsible for approving the tailoring decisions made by the system owner and security team, ensuring the selected controls adequately address the system's risk profile. The AO's approval formalizes the agreed-upon control set before it moves into implementation and assessment. This approval is a key governance step that ties control selection to the authorization decision.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
To approve the tailoring decisions.
Why this is correct
The authorisation official owns risk acceptance, so approving tailoring decisions during Control Selection ensures the resulting control set matches the system's risk tolerance. This satisfies the stem's phase-specific constraint, distinguishing the AO's approval role from the assessor's testing and the system owner's implementation duties.
- ✗
To configure the security appliances.
Why it's wrong here
Configuring appliances is a system administrator's implementation task; the AO selects and approves controls, then accepts residual risk. It tempts because the AO oversees the security posture, yet configuration is operational execution, not authorisation, so the role boundary is crossed.
- ✗
To write the security policy.
Why it's wrong here
The AO authorises the system to operate and accepts residual risk; security policy authorship belongs to the security architect or policy owner. Writing policy would be the AO's task only in small organisations where that role is formally combined with information security responsibilities.
- ✗
To perform the technical assessment.
Why it's wrong here
Technical assessment is performed by assessors who test controls and report findings; the AO uses those results to make risk-based authorisation decisions. It tempts because the AO must understand assessment evidence, but hands-on testing belongs to the assessment team, not the authorising role.
About these practice questions
One of 341 original CGRC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
You might also like
Similar CGRC questions
- A security manager is tailoring a NIST SP 800-53 control baseline for a system that processes sensitive but unclassified…
- When selecting controls for a system that uses mobile devices, you apply an overlay. What is the correct relationship be…
- Which THREE of the following are benefits of using the NIST 800-53 control framework?
- You are a risk analyst reviewing a system's security plan. The system inherits a control from a common control provider.…
- When utilizing the NIST 800-53 control catalog, which field identifies the specific family to which a control belongs?
Written and reviewed by Johnson Ajibi, MSc IT Security
Security Systems Architect · founder of Courseiva
Last reviewed September 2026 · checked against the official (ISC)² exam blueprint
This CGRC practice question is part of Courseiva's free (ISC)² certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CGRC exam.