CGRC Practice Question: When defining the scope of an information system, what is the primary purpose of…
When defining the scope of an information system, what is the primary purpose of identifying 'common controls'?
⚠ Common exam trap
CGRC often tests the misconception that common controls are excluded from the SSP or must be retested per system, when in fact they are documented as inherited and assessed once by the common control provider.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To identify controls that are implemented once and applied to multiple systems.
Common controls are security controls that are implemented once — typically at the organization, facility, or shared-service level — and inherited by multiple information systems. Identifying them during scope definition lets the organization document inheritance in each system's SSP, avoid duplicative testing, and focus system-specific assessment on controls not covered by the common provider. This is a core RMF/SP 800-37 concept for efficient authorization.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
To ensure they are manually tested for every individual system.
Why it's wrong here
Common controls are assessed once by the providing organisation and inherited, so per-system manual testing duplicates effort. Identifying them is tempting because assurance matters, but the mechanism is inheritance of assessment results, not repeated testing. The correct purpose is to reduce redundant assessment and documentation across systems sharing those controls.
- ✗
To increase the system's FIPS 199 impact level.
Why it's wrong here
Common controls are inherited by multiple systems and documented once; they do not alter a system's FIPS 199 impact level, which derives from the confidentiality, integrity and availability categorisation of the information processed. Identifying them is tempting because it streamlines authorisation, but impact level is set by data sensitivity, not control inheritance.
- ✓
To identify controls that are implemented once and applied to multiple systems.
Why this is correct
Common controls are security measures inherited by multiple systems from a shared provider, such as an enterprise data centre's physical access controls. Identifying them during scoping avoids duplicating assessment effort, letting each system document inheritance rather than reimplementing the same control.
- ✗
To exclude them from the System Security Plan (SSP).
Why it's wrong here
Common controls are referenced within the SSP, not excluded from it; the SSP documents how inherited controls apply to the system. Identifying them is tempting because it avoids duplicating documentation across systems, but the purpose is to record inheritance and responsibility, not to remove them from the plan.
About these practice questions
One of 341 original CGRC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
You might also like
Similar CGRC questions
- Which THREE of the following are essential components of an effective system inventory for a federal agency? (Select THR…
- Which of the following is an example of a 'System Boundary' document that assists with the RMF process?
- An Information System Owner (ISO) is deciding whether to include a legacy database within a new application's authorizat…
- A system owner is defining the authorization boundary for a new information system that will process personally identifi…
- Which document is mandatory to finalize the system categorization and begin the RMF process?
Written and reviewed by Johnson Ajibi, MSc IT Security
Security Systems Architect · founder of Courseiva
Last reviewed September 2026 · checked against the official (ISC)² exam blueprint
This CGRC practice question is part of Courseiva's free (ISC)² certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CGRC exam.