Certified in Governance, Risk, and Compliance (CGRC) Free Sample Questions

The authorization boundary must encompass all components essential for the system's mission. By excluding the on-premises ingestion servers, which are integral to the data processing workflow, the agency creates a significant gap in its risk assessment. Vulnerabilities in these excluded servers could be exploited to compromise the data's integrity or confidentiality before it even reaches the assessed and authorized cloud environment. This introduces unmanaged risk, undermining the entire authorization effort.

According to NIST SP 800-137, a key part of the 'Monitor' step is not just collecting security data but analyzing and responding to it to maintain a current understanding of security posture. The scenario describes data collection (scans, reviews) but fails to incorporate ongoing analysis and response. Delaying the review of findings until the annual assessment defeats the purpose of continuous monitoring, which is to enable timely risk-based decisions. The process lacks the 'Analyze and Report' and 'Respond' functions of a mature monitoring program.

This statement is false. The selection of a control baseline (Low, Moderate, High) is directly driven by the FIPS 199 security categorization of the system. An organization cannot change the baseline itself due to cost. Tailoring allows for the modification or removal of specific controls within the selected baseline, provided there is a sound risk-based justification. However, the fundamental baseline corresponding to the system's impact level must be used as the starting point.

The RMF 'Prepare' step begins at the organization level. Before any system-specific activities can be effectively carried out, the organization must establish its overarching risk management strategy. This includes defining risk tolerance, identifying common controls, and establishing the roles and responsibilities for risk management. This strategic foundation guides all subsequent RMF steps for all systems, including the wealth management platform. System registration and SSP development are system-level tasks that follow the establishment of this organizational strategy. Assessing common controls is part of the strategy but is not the strategy itself.

NIST SP 800-53, control AU-5, explicitly requires the system to "Alert designated organizational officials in the event of an audit processing failure." The implemented solution of shutting down the system addresses part of the potential response, but without the required alerting mechanism, the control is not fully satisfied. A silent failure could lead to a prolonged, unnoticed outage. The conflict with availability is a separate risk consideration, but the direct reason the control is not satisfied is the missing alert function.

The POA&M is a critical document for risk management. Its inclusion in the authorization package acknowledges that the system is not perfect but demonstrates a formal plan to systematically address and mitigate identified weaknesses over time. This allows the Authorizing Official to understand the current residual risk and the organization's commitment to reducing it, enabling an informed, risk-based decision on whether to grant an ATO.

The RMF process allows for tailoring, but it must be a deliberate, risk-based process. Simply omitting controls due to 'operational constraints' without analysis is unacceptable. The correct procedure is for the system owner to provide a formal justification for why a baseline control is not applicable or cannot be implemented, assess the residual risk, and propose compensating controls that provide an equivalent level of security. The ISSO's role is to enforce this process before the SSP is considered complete.

FIPS 199 mandates the use of the 'high water mark' principle for determining the overall system categorization. The final categorization is the highest impact level assigned to any of the three security objectives (Confidentiality, Integrity, Availability). In this case, the impact levels are {Confidentiality: Moderate, Integrity: Moderate, Availability: Low}. The highest impact level is Moderate, so the overall system categorization is Moderate.

A determination that a change has a 'significant' impact on the security posture of an authorized system is a primary trigger for re-authorization. This means the change is substantial enough to potentially invalidate the previous risk assessment and authorization decision. The system will likely need to go through the Assess and Authorize steps of the RMF again, focusing on the changes but often requiring a comprehensive re-assessment before a new ATO can be issued.