(ISC)2 Certified in Governance, Risk and Compliance (CGRC) (CGRC) (CGRC) — Questions 76–150

The magnitude of the change and the impact on the security controls are the two key triggers for re-authorization.

Conditions attached to an ATO represent known risks that must be tracked and mitigated through the POA&M to transition to full, unconditioned authorization.

The RADIUS server acts as the Authentication Server, validating the credentials provided by the supplicant via the authenticator.

NIST compliance requires a review of the SSP, the assessment of the controls, and the documentation of any deficiencies in a POA&M.

The ISSO must document the finding in the SAR and work with the system owner to document the mitigation in a POA&M.

Sanitizing the media, updating the inventory, and documenting the destruction process are all critical steps for classified systems.

Incorporating security requirements into the contract (like FAR/DFARS clauses) ensures the contractor is legally bound to meet security standards.

The Information System Owner (ISO) is responsible for the categorization, which is then approved by the Authorizing Official (AO).

The AO is accountable for the risk the system poses to the organization and must approve the mitigation strategy outlined in the POA&M.

Reviewing /etc/passwd and /etc/group files and comparing user permissions against assigned roles is a direct method to verify least privilege.

The AO reviews and approves the selected control set to ensure it meets the risk appetite of the organization.

For a control to be N/A, there must be a valid justification based on the system's architecture or operational environment.

Legacy systems often lack support for modern automation tools and are difficult to patch without downtime.

The assessor (auditor), the system owner (responsible party), and the security officer (compliance expert) are key participants.

The Plan of Action and Milestones (POA&M) is the standard document used to track the remediation of security control deficiencies.

A POA&M must define the vulnerability/weakness and the specific milestone/date for remediation.

Overlays are used to augment the base control set; they don't replace the baseline but tailor it for a specific context.

The framework provides a common language and structured approach to security that helps organizations manage risk effectively.

Technical controls (also called logical controls) use technology to enforce security.

Using a pre-authorized CSP means the government has already assessed the security controls, reducing the need for redundant assessments.

A System Interconnection Agreement (SIA) or Data Use Agreement (DUA) provides the formal record of cross-boundary data flows.

The System Security Plan and the associated configuration baselines must be kept current to reflect the system's actual state.

NIST SP 800-60 is the guide for mapping information types to FIPS 199 security objectives.

Control identifiers in NIST 800-53 follow a format such as AC-2, where 'AC' refers to the Access Control family.

Executive sponsorship and clear ownership are foundational for any governance program.

Compensating controls require rigorous documentation to ensure the auditor can verify that the risk is mitigated effectively.

Defining the boundary requires understanding the system's operational scope, its connection points, and its data ownership.

The Authorization Package consists of the SSP, SAR, and POA&M as the core elements for the AO.

Disabling unnecessary services, updating software, and using minimal feature sets are key to reducing the attack surface.

You must define the target (what good looks like), determine the current state (as-is), and then identify the delta (gap).

This discrepancy indicates a failure in the synchronization between the patch management process and the vulnerability management detection phase.

Common controls are inherited from the organization or another system, reducing the burden on the individual system owner.

'Reduction in audit findings' directly correlates to lower operational risk and better compliance posture, which resonates with stakeholders.

An inventory must track hardware, software, and operational connections to be useful for risk management.

Deleting the VM is not enough; you must verify that the underlying storage blocks have been properly sanitized or that the keys used to encrypt the data have been destroyed.

The high water mark ensures that the entire system is protected at the level of its most sensitive component.

Workflow automation engines in GRC platforms use conditional logic transitions to route tasks based on field values like 'Severity'.

A boundary diagram or description is required for the System Security Plan to define what is subject to assessment.

NIST categorizes controls into Technical, Management, and Operational families.

According to NIST SP 800-53A, the assessment process is a linear flow where the 'Prepare for Assessment' phase leads directly into the 'Assess Security Controls' phase to execute the test procedures.

This is the principle of Least Privilege, specifically using NTFS permissions to restrict write/delete access.

Tailoring allows for the modification of the baseline, but those modifications must be documented and justified.

A system-specific control is one that is implemented solely by the information system and is not inherited from an enterprise service.

Filtering at the forwarder level prevents unnecessary ingestion of logs, saving storage and improving performance.

When a patch cannot be applied, compensating controls must be implemented and documented to mitigate the risk.

Refinement is the process of adjusting the implementation of a control to be more specific to the technology or mission.

If the new application relies on the database for security or operational functionality, it must be included.

The web server's SSL/TLS configuration file (e.g., httpd.conf or nginx.conf) defines the supported cipher suites.

For inherited controls, the system owner must verify the 'Inheritance Agreement' or the 'Common Control Provider' documentation to ensure the control is actually in place and operating correctly.

The sshd_config file contains the 'PermitRootLogin' directive which must be set to 'no' for compliance.

The AO is the final risk decision maker and is accountable for the system's security status.

In a cloud environment, the provider manages the physical and infrastructure controls (inherited), meaning the assessor focuses on verifying the provider's attestations (like SOC 2 reports).

Security groups are stateful; allowing inbound traffic automatically allows the return traffic, and the default is to deny all other traffic.

Antivirus/EDR and regular patching are the primary technical controls for endpoint malware protection.

The Cisco ASA uses an 'implicit deny' at the end of every access-list, and the order of rules matters.

The FIPS 199 Categorization document (or the categorization section of the SSP) is required to select appropriate security controls.

S3 Block Public Access settings provide a centralized, account-wide or bucket-level override to prevent accidental exposure.

Compensating controls provide an alternative way to achieve the security objective; examples include increased monitoring, network isolation, or enhanced access auditing.

The System Security Plan (SSP) describes the system and the controls that have been selected (tailored) to meet security requirements.

A pre-assessment or kickoff meeting ensures alignment on scope, timeline, logistics, and points of contact between the auditor and the client.

Internal audits are conducted by the organization's own staff to improve internal processes and compliance before formal external audits occur.

The Authorization Decision Document (ADD) or ATO letter is the formal record of the AO's decision.

The SAR provides the technical assessment, and the POA&M identifies how identified weaknesses will be addressed.

The 'Organization Hierarchy' or 'Entity Manager' module defines the business structure within the GRC platform.

Dashboards and reporting widgets are designed to aggregate data from underlying assessment records for executive consumption.

If a control or family is not applicable to the system's function, it should be scoped out or documented as not applicable during the tailoring process.

The SSP describes the controls that *should* be in place, and the SAR reports on whether those controls are actually effective.

Integrity is managed via audit trails, access controls, and data validation rules.

Storing recovery keys in Active Directory Domain Services (AD DS) ensures central management and recovery capability for IT staff.

Risk acceptance must document the specific risk, the impact, and the duration or justification for accepting it.

The Rules of Engagement (ROE) define the boundaries, scope, and procedures for an assessment, ensuring both parties understand the limitations.

A 'Scheduled Assessment' or 'Workflow Trigger' based on 'Vendor Criticality' ensures compliance with due diligence timelines.

Using pre-built API connectors or 'Data Integrators' provided by the GRC platform is the standard way to ingest external security data.

Security in the cloud is a shared endeavor where the provider covers the infrastructure and the customer covers the configuration and data.

NIST SP 800-53B provides the control baselines for the various impact levels.