CGRC Practice Question: Which document defines the security control baselines (Low, Moderate, High) for federal…
Which document defines the security control baselines (Low, Moderate, High) for federal information systems?
⚠ Common exam trap
CGRC often tests the confusion between NIST SP 800-53B (baselines) and SP 800-53A (assessment procedures), or FIPS 199 (categorization), so candidates must memorize the exact scope of each publication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NIST SP 800-53B.
NIST SP 800-53B, 'Control Baselines for Information Systems and Organizations,' is the document that defines the Low, Moderate, and High security control baselines. It provides the specific control sets that correspond to each FIPS 199 impact category, serving as the starting point for tailoring in the RMF. SP 800-53B is the authoritative source for baseline selection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
NIST SP 800-53B.
Why this is correct
NIST SP 800-53B supplies the actual Low, Moderate and High baseline control selections, derived from the SP 800-53 catalogue, that federal information systems must implement. It satisfies the stem's requirement for a document defining those three baselines, whereas SP 800-53 itself provides the broader control catalogue without baseline allocation.
- ✗
NIST SP 800-53A.
Why it's wrong here
NIST SP 800-53A provides assessment procedures for determining control effectiveness, not the Low, Moderate and High baselines themselves. It is tempting because it accompanies SP 800-53, but its axis is assessment methodology, whereas SP 800-53B defines the baseline control sets.
- ✗
FIPS 199.
Why it's wrong here
FIPS 199 defines security categorisation of information and systems as Low, Moderate or High impact; it does not define the control baselines themselves. It is tempting because it uses the same three labels, but its axis is impact categorisation, whereas SP 800-53B maps those categories to baseline controls.
- ✗
NIST SP 800-37.
Why it's wrong here
NIST SP 800-37 describes the Risk Management Framework process for authorising systems, not the baseline control selections. It is tempting because it governs the RMF steps that consume baselines, but its axis is process, whereas SP 800-53B defines the Low, Moderate and High baseline control sets.
About these practice questions
Courseiva writes every CGRC question from scratch — 341 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
You might also like
Similar CGRC questions
- A control in the NIST 800-53 catalog has a parameter that reads: '[Assignment: organization-defined frequency]'. What is…
- You are tailoring a baseline and encounter a control marked as 'Not Applicable'. What is the correct documentation appro…
- Which TWO of the following are valid reasons for tailoring a NIST 800-53 control baseline?
- A system owner determines that a specific NIST 800-53 control cannot be implemented due to legacy hardware constraints.…
- Your organization is applying NIST SP 800-53 controls to a hybrid cloud infrastructure. What is the main purpose of util…
Written and reviewed by Johnson Ajibi, MSc IT Security
Security Systems Architect · founder of Courseiva
Last reviewed September 2026 · checked against the official (ISC)² exam blueprint
This CGRC practice question is part of Courseiva's free (ISC)² certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CGRC exam.