CGRC Practice Question: Which THREE factors should an organization consider when applying control overlays?
Which THREE factors should an organization consider when applying control overlays?
⚠ Common exam trap
CGRC often tests the criteria for overlays; candidates may select irrelevant factors like administrator preference or purchase date instead of mission, impact, and baseline.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The mission or business requirements of the system.
Control overlays are tailored sets of controls applied on top of a baseline, so they must be driven by the system's mission or business requirements (C), since the overlay exists to address specific needs such as privacy, cloud, or industrial control environments that the baseline alone does not cover. The impact level of the underlying system (D) matters because FIPS 199/SP 800-53 baselines are selected by impact (low, moderate, high), and the overlay must be consistent with that categorization and the associated control rigor. The existing control baseline of the system (E) is also essential, because an overlay is applied relative to an already-selected baseline, and knowing which controls are already implemented or inherited prevents duplication and gaps. By contrast, the personal preference of the system administrator (A) is not a valid factor, since overlays must be justified by mission, risk, and compliance needs rather than individual taste, and the date the system was originally purchased (B) is irrelevant to overlay selection, as age of hardware does not determine which controls are required.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The personal preference of the system administrator.
Why it's wrong here
Control overlays are selected from the system's categorisation, threat environment, legal and regulatory obligations, and organisational risk tolerance. An administrator's personal preference is subjective and unauditable, and would only be relevant to usability decisions within an already-approved overlay baseline.
- ✗
The date the system was originally purchased.
Why it's wrong here
Overlay selection depends on current risk, data sensitivity, applicable laws and the operational context the system now supports. Purchase date says nothing about those; it would matter only for asset lifecycle or warranty planning, not for determining which supplementary controls a system requires.
- ✓
The mission or business requirements of the system.
Why this is correct
Overlays must reflect what the system actually does, so mission or business requirements drive which additional controls are layered onto the baseline. This ensures the overlay supports the system's purpose, satisfying the stem's requirement for a factor considered when applying overlays.
- ✓
The impact level of the underlying system.
Why this is correct
Overlays are tailored according to the system's categorised impact level, since low, moderate and high systems attract different additional controls. Considering impact level ensures the overlay applied matches the risk profile, satisfying the stem's requirement for a factor in overlay selection.
- ✓
The existing control baseline of the system.
Why this is correct
The baseline already selected for the system determines which controls exist, so the overlay only adds or modifies the remainder. Reviewing the existing baseline prevents duplication and gaps, satisfying the stem's requirement for a factor considered when applying control overlays.
About these practice questions
Courseiva writes every CGRC question from scratch — 341 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
You might also like
Similar CGRC questions
- A security analyst is selecting controls for a new web application hosted in a public cloud IaaS environment. The organi…
- You are tailoring a NIST SP 800-53 baseline for a new system. The system owner asks you to identify the reasons why a co…
- You are preparing a security plan for a federal information system categorized as MODERATE impact. According to NIST SP…
- You are selecting controls for a cloud-based system that will be used by a government agency. The cloud service provider…
- You are tailoring the NIST SP 800-53 Rev. 5 Moderate baseline for a system that will be deployed in a tactical edge envi…
Written and reviewed by Johnson Ajibi, MSc IT Security
Security Systems Architect · founder of Courseiva
Last reviewed September 2026 · checked against the official (ISC)² exam blueprint
This CGRC practice question is part of Courseiva's free (ISC)² certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CGRC exam.