CGRC Practice Question: Tailoring controls for a system that does not process PII
You are tailoring controls for a system that does not process PII. Which action should you take regarding the Privacy (PRIV) family controls in the NIST 800-53 catalog?
⚠ Common exam trap
CGRC often tests the difference between 'not applicable' (tailored out with justification) and 'not implemented' (a finding) — candidates who think removing a control family is forbidden pick A or D instead of the correct documented-removal answer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Document the removal of the family with a justification.
NIST SP 800-53B and the RMF allow organizations to tailor the control baseline by removing controls that are not applicable — but any removal must be documented with a justification in the system security plan or tailoring worksheet. Since the system does not process PII, the PRIV family is not applicable, so the correct action is to document the removal with a rationale rather than silently dropping it or implementing it anyway.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Replace the family with general security controls.
Why it's wrong here
Tailoring permits scoping out controls that are not applicable, so PRIV controls can be marked not applicable with justification rather than swapped for security controls. It is tempting to substitute other controls, but the PRIV family addresses privacy risks that general security controls do not cover.
- ✗
Keep the controls but set them to 'manual' mode.
Why it's wrong here
NIST 800-53 controls have no 'manual mode'; the PRIV family is selected or scoped out during tailoring, not toggled between automated and manual execution. Keeping inapplicable privacy controls inflates the assessment boundary. Manual designation suits controls whose evidence collection genuinely requires human judgement, such as personnel screening or physical escort procedures.
- ✓
Document the removal of the family with a justification.
Why this is correct
Tailoring permits removal of controls that are not applicable, but the decision must be documented with justification to preserve the audit trail. Since the system processes no PII, the Privacy family can be excluded, provided the rationale is recorded in the tailoring documentation.
- ✗
Implement the controls as high-priority items.
Why it's wrong here
Priority ranking does not determine applicability; PRIV controls address privacy requirements arising from PII processing, which this system does not perform. Marking them high-priority still forces implementation and assessment effort. High-priority designation is correct when a control is applicable but critical to the system's security categorisation, not when the family is out of scope.
About these practice questions
One of 341 original CGRC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
You might also like
Similar CGRC questions
- Which document defines the security control baselines (Low, Moderate, High) for federal information systems?
- A control in the NIST 800-53 catalog has a parameter that reads: '[Assignment: organization-defined frequency]'. What is…
- You are tailoring a baseline and encounter a control marked as 'Not Applicable'. What is the correct documentation appro…
- Which TWO of the following are valid reasons for tailoring a NIST 800-53 control baseline?
- A system owner determines that a specific NIST 800-53 control cannot be implemented due to legacy hardware constraints.…
Written and reviewed by Johnson Ajibi, MSc IT Security
Security Systems Architect · founder of Courseiva
Last reviewed September 2026 · checked against the official (ISC)² exam blueprint
This CGRC practice question is part of Courseiva's free (ISC)² certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CGRC exam.