CGRC Practice Question: Which document is mandatory to finalize the system categorization and begin the RMF…
Which document is mandatory to finalize the system categorization and begin the RMF process?
⚠ Common exam trap
CGRC often tests the sequence of RMF steps, and candidates may confuse later artifacts like the Contingency Plan or Penetration Test Report as prerequisites, when the FIPS 199 categorization is the mandatory first step.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The FIPS 199 Security Categorization document.
The FIPS 199 Security Categorization document is mandatory to finalize the system categorization and formally begin the RMF process. It documents the security category of the system based on the potential impact of a breach, and without it, the subsequent RMF steps (selecting controls, assessing, authorizing) cannot be properly executed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The Incident Response Policy.
Why it's wrong here
The Incident Response Policy governs how breaches are handled and does not feed the categorisation step. It would be the right artefact when defining detection, containment and reporting procedures, not when establishing impact level from FIPS 199 information types.
- ✗
The Penetration Test Report.
Why it's wrong here
A penetration test report documents exploitable weaknesses found during security testing, so it cannot authorise system categorisation or initiate the RMF. It is tempting because penetration testing validates controls during the Assess step, and would be the right artefact when evidence of adversarial resilience is required after implementation.
- ✓
The FIPS 199 Security Categorization document.
Why this is correct
FIPS 199 categorisation assigns the confidentiality, integrity and availability impact levels that drive every subsequent RMF step, so the completed Security Categorization document is the mandatory artefact that formally closes categorisation and authorises the process to begin.
- ✗
The Contingency Plan.
Why it's wrong here
A Contingency Plan documents recovery procedures for a system already within the RMF, so it cannot finalise categorisation or initiate the process. It is tempting because contingency planning is a genuine RMF step, and would be the right artefact when addressing recovery requirements during the later Select and Implement phases, not at categorisation.
About these practice questions
One of 341 original CGRC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
You might also like
Similar CGRC questions
- A program manager is preparing documentation for a new system and needs to describe the system boundary. Which artifact…
- A federal agency is defining the authorization boundary for a new system that will process controlled unclassified infor…
- A Security Control Assessor is reviewing the authorization boundary of a high-impact system that uses a shared common co…
- A security assessor is reviewing a system boundary for a high-impact system. The boundary includes a web server, an appl…
- An Information System Owner (ISO) is defining the authorization boundary for a system that consists of a web front-end,…
Written and reviewed by Johnson Ajibi, MSc IT Security
Security Systems Architect · founder of Courseiva
Last reviewed September 2026 · checked against the official (ISC)² exam blueprint
This CGRC practice question is part of Courseiva's free (ISC)² certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CGRC exam.