CGRC Practice Question: Tailoring a baseline and encounter a control marked as 'Not Applicable'
You are tailoring a baseline and encounter a control marked as 'Not Applicable'. What is the correct documentation approach?
⚠ Common exam trap
CGRC often tests the misconception that 'Not Applicable' controls can be simply deleted or marked as implemented, when in fact they must be documented with justification in the SSP.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Document the removal and the justification in the SSP.
When a control is marked 'Not Applicable' during tailoring, the correct approach is to document the removal and provide a justification in the System Security Plan (SSP). This ensures transparency and auditability, allowing authorizing officials to understand why the control was excluded. The SSP serves as the primary documentation for control implementation and tailoring decisions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Mark the control as 'Implemented' and leave the field blank.
Why it's wrong here
Recording 'Implemented' with a blank field misrepresents the control's status and leaves no audit trail. 'Not Applicable' demands a written justification explaining why the control falls outside the system boundary. Marking implemented suits controls that are genuinely in place and evidenced.
- ✓
Document the removal and the justification in the SSP.
Why this is correct
Tailoring requires that any control deemed not applicable be removed from the baseline and the rationale recorded. The SSP is the authoritative document capturing the tailored control set, so recording both the removal and its justification there preserves the audit trail and satisfies the traceability constraint.
- ✗
Request a waiver from the CISO.
Why it's wrong here
A waiver is a formal risk-acceptance instrument for controls that cannot be met, not for controls genuinely outside the system boundary. Marking 'Not Applicable' requires documented justification in the SSP, not CISO sign-off. Waivers would be correct where a control applies but cannot be implemented.
- ✗
Just delete the control from the system security plan (SSP).
Why it's wrong here
Deleting the control removes it from the SSP entirely, destroying the tailoring audit trail and traceability to the baseline. The control must remain listed with a documented 'Not Applicable' justification. Deletion would suit controls never selected into the baseline during initial scoping.
About these practice questions
One of 341 original CGRC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
You might also like
Similar CGRC questions
- Which TWO of the following are valid reasons for tailoring a NIST 800-53 control baseline?
- A system owner determines that a specific NIST 800-53 control cannot be implemented due to legacy hardware constraints.…
- Your organization is applying NIST SP 800-53 controls to a hybrid cloud infrastructure. What is the main purpose of util…
- A security architect is selecting controls for a new payroll processing system that handles PII and is deployed on-premi…
- When selecting controls, you notice that a specific NIST 800-53 control includes 'assignment' statements. What is the pu…
Written and reviewed by Johnson Ajibi, MSc IT Security
Security Systems Architect · founder of Courseiva
Last reviewed September 2026 · checked against the official (ISC)² exam blueprint
This CGRC practice question is part of Courseiva's free (ISC)² certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CGRC exam.