CGRC Practice Question: When utilizing the NIST 800-53 control catalog, which field identifies the specific…
When utilizing the NIST 800-53 control catalog, which field identifies the specific family to which a control belongs?
⚠ Common exam trap
CGRC often tests the components of NIST 800-53 controls; candidates may confuse the control ID prefix with other fields like priority tags or parameters.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Control ID prefix.
In NIST SP 800-53, controls are identified by a unique control ID that consists of a two-letter family prefix followed by a number (e.g., AC-1 for Access Control). The prefix indicates the control family. Therefore, the control ID prefix (Option C) identifies the specific family to which a control belongs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Control priority tag.
Why it's wrong here
A control priority tag indicates implementation sequencing or emphasis, not family membership. It is tempting because priority values appear in catalogue fields, but the family is identified by the control's identifier prefix and family name, which priority tagging does not encode.
- ✗
The assignment statement.
Why it's wrong here
Assignment statements populate parameter values within a control, not the family to which it belongs. It is tempting because assignments appear alongside controls in the catalogue, yet family membership is conveyed by the control identifier prefix and family designation, which assignment statements do not carry.
- ✓
Control ID prefix.
Why this is correct
Each NIST 800-53 control identifier begins with a two-letter prefix denoting its family, such as AC for access control or AU for audit. The prefix therefore identifies family membership directly, satisfying the stem's requirement without needing the control title or enhancement fields.
- ✗
The control parameter list.
Why it's wrong here
The control parameter list holds the assignment and selection values for a control's parameters, not its family grouping. It is tempting because parameters appear within each control entry, but the family is identified by the control's two-letter identifier prefix and the family field, not by parameter data.
About these practice questions
One of 341 original CGRC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
You might also like
Similar CGRC questions
- Which THREE of the following are components that must be included when documenting a compensating control?
- A security analyst is selecting controls for a new information system based on NIST SP 800-53 Rev. 5. The system has bee…
- You are a security consultant helping a financial institution select controls for a new mobile banking application. The…
- Which TWO of the following statements regarding the 'Tailoring' process are accurate?
- A security team is selecting controls for a system that will use a cloud-based infrastructure. They need to determine wh…
Written and reviewed by Johnson Ajibi, MSc IT Security
Security Systems Architect · founder of Courseiva
Last reviewed September 2026 · checked against the official (ISC)² exam blueprint
This CGRC practice question is part of Courseiva's free (ISC)² certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CGRC exam.