CGRC Practice Questions

Reciprocity is the principle of reusing assessment results and authorization decisions across different organizations or systems to reduce redundant testing and effort. It is a key concept in frameworks like FedRAMP and is encouraged by the RMF to improve efficiency, as long as the reused information is verified to be trustworthy.

This statement is false. The POA&M is a dynamic risk management tool. It is a key input to the continuous monitoring process ('Monitor' step). The status of POA&M items must be regularly tracked, updated as remediation activities progress, and reviewed to ensure weaknesses are being addressed in a timely manner. It is a living document throughout the system's lifecycle.

Tailoring decisions must be based on a risk assessment, not user preference or convenience. AC-11 is a critical control for protecting against unauthorized access to unattended sessions, directly supporting the confidentiality objective. For a High confidentiality system, the risk of not implementing this control is significant. A justification based on inconvenience is insufficient and would likely be rejected by an assessor and the AO.

NIST SP 800-60 provides a standardized catalog of information type categories (e.g., 'Logistics', 'Financial Management'). The purpose is to create consistency in categorization across the federal government. After identifying the business-specific information types ('shipping manifests'), the next step is to map them to these standard categories. This mapping then provides a provisional impact level (e.g., Logistics is provisionally Low-Moderate-Low), which serves as a starting point for the final FIPS 199 categorization.

The security objective of Availability is to ensure timely and reliable access to and use of information. A power outage that makes a system inaccessible is a direct impact on its availability. While the recovery plan worked, the initial event was an availability failure. Confidentiality relates to preventing unauthorized disclosure, and Integrity relates to preventing improper modification.

The core purpose of the Security Assessment Plan is to provide a detailed roadmap for how the assessment will be conducted. This includes specifying the exact procedures—derived from NIST SP 800-53A—that will be used to verify each control's implementation. This level of detail ensures the assessment is comprehensive, repeatable, and transparent to all stakeholders, especially the system owner. While other elements like personnel and schedules are included, the procedures are the heart of the plan.

The authorization boundary must encompass all components essential for the system's mission. By excluding the on-premises ingestion servers, which are integral to the data processing workflow, the agency creates a significant gap in its risk assessment. Vulnerabilities in these excluded servers could be exploited to compromise the data's integrity or confidentiality before it even reaches the assessed and authorized cloud environment. This introduces unmanaged risk, undermining the entire authorization effort.

According to NIST SP 800-137, a key part of the 'Monitor' step is not just collecting security data but analyzing and responding to it to maintain a current understanding of security posture. The scenario describes data collection (scans, reviews) but fails to incorporate ongoing analysis and response. Delaying the review of findings until the annual assessment defeats the purpose of continuous monitoring, which is to enable timely risk-based decisions. The process lacks the 'Analyze and Report' and 'Respond' functions of a mature monitoring program.