CGRC Practice Questions

A security control baseline is the starting point for the security control selection process within the NIST Risk Management Framework (RMF). It represents the initial set of minimum security controls for an information system, based on its designated impact level (low, moderate, or high) as determined by FIPS 199. These baselines, defined in NIST SP 800-53, are intended to be tailored—by adding, removing, or modifying controls—to align with an organization's specific mission, environment, and risk tolerance. The baseline provides a standardized and cost-effective approach to securing information systems with similar characteristics and requirements.

B. Minimum Security Baselines: This is not the official terminology used by NIST. While a baseline does represent a minimum set of controls, the correct term is "Security Control Baseline."

C. None of these: This is incorrect because option A accurately defines the concept described in the question according to official NIST documentation.

D. Revised Control Baseline: This is not a standard term within the NIST RMF. A baseline is tailored or supplemented during the control selection process, but this is not its formal name.

1. NIST Special Publication (SP) 800-53, Revision 5, Security and Privacy Controls for Information Systems and Organizations. (December 2020).

Appendix B, Glossary: Defines "Security control baseline" as "A set of controls that are established for a system or organization to provide a starting point for the development of a security or privacy plan."

Section 2.3, Control Selection Process: States, "The process begins with the selection of a baseline set of controls from this publication based on the security categorization and impact level of the system..."

2. NIST Special Publication (SP) 800-37, Revision 2, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy. (December 2018).

Appendix B, Glossary: Defines "Security Control Baseline" as "The set of controls that are established for a system or organization to provide a starting point for the development of a security or privacy plan."

Section 2.3, Task S-1 (CONTROL SELECTION): Describes the process of selecting an initial set of controls from a baseline based on the system's security categorization.

3. Federal Information Processing Standards (FIPS) Publication 200, Minimum Security Requirements for Federal Information and Information Systems. (March 2006).

Section 3, Minimum Security Requirements: States, "The selection of baseline security controls for an information system is a key activity... NIST SP 800-53... contains the catalog of security controls and specifies baseline security controls for low-impact, moderate-impact, and high-impact information systems."

The statement is definitively false. The core objectives of Configuration Management (CM) and its associated controls are precisely to document all proposed and actual changes to an information system and to assess the security impact of those changes. This process is fundamental to maintaining the security posture, integrity, and operational stability of a system. The statement claims the opposite, which misrepresents the entire purpose of the Configuration Management domain.

This is a True/False question. The option "True" is incorrect because it would imply that the function of Configuration Management is to avoid documenting changes and assessing their impact. This contradicts the foundational principles of information system security and governance as established in all major frameworks. Effective CM is impossible without rigorous documentation and impact analysis.

1. NIST Special Publication (SP) 800-53, Revision 5, Security and Privacy Controls for Information Systems and Organizations.

Control CM-3, Configuration Change Control: This control explicitly requires organizations to "a. Determine the types of configuration changes that are to be controlled...; b. Approve or disapprove configuration change requests with explicit consideration for security and privacy impacts; [and] c. Document configuration change decisions associated with the system..." (Page 133).

Control CM-4, Security and Privacy Impact Analysis: This control is entirely dedicated to the concept negated in the question. It mandates that "The organization: a. Analyzes changes to the system to determine potential security and privacy impacts prior to change implementation; and b. Documents the security and privacy impact analysis." (Page 134).

2. NIST Special Publication (SP) 800-128, Guide for Security-Focused Configuration Management of Information Systems.

Section 2.2.3, Configuration Change Control: This section states, "Configuration change control is the systematic proposal, justification, implementation, testing, review, and disposition of changes to the system... The process includes managing and controlling all changes to the system configuration... The configuration change control process also ensures that the security impact of any change is analyzed and documented." (Page 8). This directly refutes the premise of the question.