CGRC Sample Questions & Answers

NIST SP 800-53, control AU-5, explicitly requires the system to "Alert designated organizational officials in the event of an audit processing failure." The implemented solution of shutting down the system addresses part of the potential response, but without the required alerting mechanism, the control is not fully satisfied. A silent failure could lead to a prolonged, unnoticed outage. The conflict with availability is a separate risk consideration, but the direct reason the control is not satisfied is the missing alert function.

The POA&M is a critical document for risk management. Its inclusion in the authorization package acknowledges that the system is not perfect but demonstrates a formal plan to systematically address and mitigate identified weaknesses over time. This allows the Authorizing Official to understand the current residual risk and the organization's commitment to reducing it, enabling an informed, risk-based decision on whether to grant an ATO.

The RMF process allows for tailoring, but it must be a deliberate, risk-based process. Simply omitting controls due to 'operational constraints' without analysis is unacceptable. The correct procedure is for the system owner to provide a formal justification for why a baseline control is not applicable or cannot be implemented, assess the residual risk, and propose compensating controls that provide an equivalent level of security. The ISSO's role is to enforce this process before the SSP is considered complete.

FIPS 199 mandates the use of the 'high water mark' principle for determining the overall system categorization. The final categorization is the highest impact level assigned to any of the three security objectives (Confidentiality, Integrity, Availability). In this case, the impact levels are {Confidentiality: Moderate, Integrity: Moderate, Availability: Low}. The highest impact level is Moderate, so the overall system categorization is Moderate.

A determination that a change has a 'significant' impact on the security posture of an authorized system is a primary trigger for re-authorization. This means the change is substantial enough to potentially invalidate the previous risk assessment and authorization decision. The system will likely need to go through the Assess and Authorize steps of the RMF again, focusing on the changes but often requiring a comprehensive re-assessment before a new ATO can be issued.

While the baseline provides a starting point, it is not sufficient for addressing all privacy risks. The RMF emphasizes that organizations must analyze the specific context in which PII is processed. This involves identifying the types of PII, the purpose of processing, and the potential problems (privacy risks) individuals could experience. Based on this analysis, the organization must select additional privacy controls and enhancements from the catalog in Appendix J of NIST SP 800-53 to supplement the baseline.

The FedRAMP authorization for the IaaS platform covers controls at the infrastructure level (CSP responsibility). The agency, as the customer, retains responsibility for a significant number of controls related to the application itself, data, access management, and configurations (customer responsibility and shared controls). The agency must implement, document, and assess these controls as part of its own authorization process. Control inheritance is not total; it operates on a shared responsibility model.

NIST SP 800-53A defines three assessment methods: Examine, Interview, and Test. The 'Test' method involves exercising or executing system functions to verify they operate as intended. A port scan is a direct test of the firewall's functionality. Reviewing configuration files is 'Examine,' and asking an administrator is 'Interview.' Observing a demonstration is a form of 'Examine' as well.

Reciprocity is the principle of reusing assessment results and authorization decisions across different organizations or systems to reduce redundant testing and effort. It is a key concept in frameworks like FedRAMP and is encouraged by the RMF to improve efficiency, as long as the reused information is verified to be trustworthy.

This statement is false. The POA&M is a dynamic risk management tool. It is a key input to the continuous monitoring process ('Monitor' step). The status of POA&M items must be regularly tracked, updated as remediation activities progress, and reviewed to ensure weaknesses are being addressed in a timely manner. It is a living document throughout the system's lifecycle.