CGRC Practice Question: Which TWO of the following statements regarding the 'Tailoring' process are accurate?
Which TWO of the following statements regarding the 'Tailoring' process are accurate?
⚠ Common exam trap
CGRC often tests the misconception that tailoring is optional or only for high-impact systems — the exam expects you to know tailoring is mandatory, occurs in the Select step, and must be documented.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Tailoring actions must be documented to justify the risk management decisions.
Option B is correct because the RMF requires that all tailoring actions be documented in the system security plan (SSP) and supporting artifacts so that the risk management decisions and their rationale are transparent and auditable. Option D is correct because tailoring is precisely the process of adjusting the initial control baseline (from NIST SP 800-53B) to account for system-specific factors such as mission needs, environment of operation, organizational constraints, and risk tolerance, resulting in the system's tailored baseline. Option A is incorrect because tailoring occurs during the Select step (Step 2) of the RMF, not the Assess step (Step 4). Option C is incorrect because tailoring applies to all systems regardless of impact level (Low, Moderate, or High). Option E is incorrect because tailoring is a required part of the RMF Select step, not an optional activity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Tailoring is performed during the Assess step.
Why it's wrong here
Tailoring occurs during Prepare, before categorisation and control selection, shaping the RMF tasks that follow; performing it in Assess is too late. It tempts because Assess examines control effectiveness and may prompt adjustments. Tailoring decisions must precede implementation so the correct controls are selected and applied.
- ✓
Tailoring actions must be documented to justify the risk management decisions.
Why this is correct
Documenting tailoring decisions creates an auditable record explaining why specific controls were adjusted, added or removed, and how residual risk was accepted. This satisfies the requirement for traceable justification of risk management decisions throughout the authorisation process.
- ✗
Tailoring is only permitted for High impact systems.
Why it's wrong here
Tailoring applies across all impact levels, scaling controls to risk, mission and environment; restricting it to high impact systems inverts that logic. It tempts because high impact systems demand the most rigorous control selection. Low and moderate systems also require tailoring, otherwise they inherit controls disproportionate to their actual risk.
- ✓
Tailoring is used to modify the baseline based on system-specific factors.
Why this is correct
Tailoring adjusts the control baseline to reflect system-specific factors such as mission, environment and risk tolerance, producing a tailored baseline rather than a generic one. This satisfies the requirement to fit controls to the system's actual operating context.
- ✗
Tailoring is optional and not required by RMF.
Why it's wrong here
Tailoring is required by the RMF, not optional; every system needs its controls adjusted to its mission, environment and risk. It tempts because tailoring permits flexibility, which sounds discretionary. The RMF expects documented tailoring decisions during Prepare, so omitting it leaves the control baseline unjustified and unsupported.
About these practice questions
Courseiva writes every CGRC question from scratch — 341 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
You might also like
Similar CGRC questions
- A security team is selecting controls for a system that will use a cloud-based infrastructure. They need to determine wh…
- If a control is determined to be 'system-specific', what does that mean?
- An organization is selecting controls for a new information system. The system is categorized as low impact. According t…
- During tailoring, what is the 'Refinement' process?
- You are assessing a system. You find a control that is marked as 'Inherited'. What is the most critical item to verify?
Written and reviewed by Johnson Ajibi, MSc IT Security
Security Systems Architect · founder of Courseiva
Last reviewed September 2026 · checked against the official (ISC)² exam blueprint
This CGRC practice question is part of Courseiva's free (ISC)² certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CGRC exam.