CGRC Practice Question: Which TWO of the following are valid reasons for tailoring a NIST 800-53 control baseline?
Which TWO of the following are valid reasons for tailoring a NIST 800-53 control baseline?
⚠ Common exam trap
CGRC often tests the misconception that cost or monitoring difficulty justifies removing controls, when in fact tailoring must be driven by applicability and risk, not convenience.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The control is not applicable to the system's technology.
Option A is correct because NIST 800-53 baselines are tailored when a control addresses technology that the system does not employ — for example, a wireless access control (AC-18) on a system with no wireless capability — making the control not applicable and eligible for removal or scoping out. Option B is correct because tailoring also includes supplementing or strengthening the baseline with additional controls or more rigorous parameters when the system's environment, threat profile, or mission demands greater assurance than the baseline provides, such as raising an audit frequency parameter. Options C and D are not valid tailoring reasons: cost and monitoring difficulty are not criteria in the NIST RMF tailoring process, which is driven by applicability, risk, and mission/business needs rather than convenience. Option E is incorrect because the system owner cannot unilaterally disagree with a FIPS 199 categorization; the categorization is based on the impact of loss of confidentiality, integrity, and availability, and disputes are resolved through the formal categorization and approval process, not by tailoring the control baseline.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The control is not applicable to the system's technology.
Why this is correct
Tailoring removes controls that cannot be implemented because the system lacks the relevant technology, such as a mainframe-only control in a cloud-native environment. This is a scoping decision documented in the system security plan, satisfying the stem's requirement for a valid, defensible reason to tailor the NIST 800-53 baseline.
- ✓
The system environment requires a specific, more rigorous implementation.
Why this is correct
Tailoring permits strengthening a control beyond the baseline when the system environment demands stricter protection, such as higher assurance for sensitive data. This is a valid scoping decision recorded in the system security plan, satisfying the stem's requirement for a legitimate reason to tailor the NIST 800-53 baseline.
- ✗
The control has a high cost of implementation.
Why it's wrong here
Cost alone does not justify tailoring; controls are selected from the FIPS 199 impact baseline, and cost only informs implementation decisions. It is tempting because budget constraints genuinely shape security architectures, making cost a legitimate factor in scoping and sequencing remediation.
- ✗
The control is too difficult to monitor.
Why it's wrong here
Monitoring difficulty is an implementation concern, not grounds for removing a control required by the impact baseline; compensating controls address that. It is tempting because operational burden does drive control selection in practice, and monitoring feasibility is assessed when designing the assessment plan.
- ✗
The system owner disagrees with the FIPS 199 classification.
Why it's wrong here
FIPS 199 categorisation is determined by impact analysis of the information types, not by the system owner's opinion, so disagreement cannot justify removing controls. It is tempting because the system owner does sign off on the security plan, which is where disagreements are normally resolved.
Visual reference
About these practice questions
This CGRC question is part of Courseiva's 341-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
You might also like
Similar CGRC questions
- A system owner determines that a specific NIST 800-53 control cannot be implemented due to legacy hardware constraints.…
- Your organization is applying NIST SP 800-53 controls to a hybrid cloud infrastructure. What is the main purpose of util…
- A security architect is selecting controls for a new payroll processing system that handles PII and is deployed on-premi…
- When selecting controls, you notice that a specific NIST 800-53 control includes 'assignment' statements. What is the pu…
- You are developing a security plan for a system that uses a NIST SP 800-53 control baseline. During control selection, y…
Written and reviewed by Johnson Ajibi, MSc IT Security
Security Systems Architect · founder of Courseiva
Last reviewed September 2026 · checked against the official (ISC)² exam blueprint
This CGRC practice question is part of Courseiva's free (ISC)² certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CGRC exam.