CGRC · Domain 3
Selection and Approval of Framework, Security and Privacy Controls
About 14% of the exam
The Select step
- Choose the baseline
- Tailor
- Allocate common, hybrid, system-specific
- Document in the SSP
- Plan continuous monitoring
- Approve the plan
- Input
- FIPS 199 categorization, risk assessment
- Baseline source
- SP 800-53B for security and privacy
- Tailoring
- fit the baseline to the system
- Allocation
- who implements which control
- Output
- approved SSP and monitoring strategy
The baseline is a starting point, never the finish line; tailoring with justification is expected
Baselines
- Low baseline
- low-impact systems, fewest controls
- Moderate baseline
- most federal systems land here
- High baseline
- severe or catastrophic impact
- Privacy baseline
- applies wherever PII is processed
- SP 800-53B
- baselines split from the catalog
- FIPS 200
- requires baseline use, minimum requirements
A High categorization means the High baseline is where tailoring begins
Tailoring actions
- Scoping
- remove controls that do not apply
- Compensating
- equivalent protection by other means
- Parameters
- fill organization-defined values
- Supplementing
- add controls for local threats
- Overlays
- prebuilt tailoring for a community
- Justify
- every removal documented and approved
SP 800-53 Rev 5 control families
Access and people
- AC
- access control
- AT
- awareness and training
- IA
- identification and authentication
- PS
- personnel security
- PE
- physical and environmental
Operations
- AU
- audit and accountability
- CM
- configuration management
- CP
- contingency planning
- IR
- incident response
- MA
- system maintenance
- MP
- media protection
- SI
- system and information integrity
- SC
- system and communications protection
Management and privacy
- CA
- assessment, authorization, monitoring
- PL
- security planning
- PM
- program management, no baseline
- RA
- risk assessment
- SA
- system and services acquisition
- SR
- supply chain risk management, new
- PT
- PII processing and transparency, new
Twenty families; Rev 5 added SR and PT and merged privacy into the single catalog
Anatomy of a control
- AC-2
- family, base control number
- AC-2(1)
- enhancement adds strength or detail
- Assignment
- organization-defined parameter to fill
- Selection
- choose from listed options
- Withdrawn
- merged elsewhere, not deleted
- Discussion
- explains intent, not a requirement
- Related controls
- dependencies to check
Choosing the framework
- SP 800-53
- federal systems and organizations
- SP 800-171
- CUI in nonfederal systems
- FedRAMP
- cloud services for agencies
- CNSSI 1253
- national security systems
- NIST CSF
- outcome language for executives
- ISO/IEC 27001
- international certifiable ISMS
- CMMC
- defense contractor maturity levels
Legal mandate first, then contract, then organizational choice
Allocating controls
- Common controls cut cost and duplication
- Common control provider authorizes them once
- Inheriting system still checks adequacy
- Hybrid splits responsibility explicitly
- System-specific stays with the system owner
- Document provider and scope in the SSP
- Provider weakness flows to every inheritor
Overlays
- Fully specified controls for a community
- Classified, privacy, industrial control, cloud
- Adds, removes, changes parameters
- Applied on top of a baseline
- Saves each system repeating the same tailoring
- Still document system-specific deviations
Privacy control selection
- PT family: authority, purposes, consent
- PT-2 authority to process PII
- PT-3 purpose specification and limitation
- PT-4 consent mechanisms
- Privacy baseline applies with PII
- SAOP reviews and approves the selection
- Privacy plan may live inside the SSP
- Data minimization shapes the selection
Approval and documentation
- Tailoring rationale recorded per control
- Parameters recorded with the values chosen
- Designation for every control
- AO or designee approves the SSP
- Monitoring strategy approved alongside
- Approval before implementation begins
- Risk assessment informs every deviation
Selection mistakes
- Scoping out a control to save effort
- Baseline adopted without tailoring
- Parameters left as blanks
- Inheritance assumed, never verified
- Compensating control weaker than original
- Overlay applied without a baseline underneath
- Privacy controls treated as security controls
- PM controls expected in a system baseline
Monitoring strategy born in Select
- Which controls monitored, how often
- Frequency tied to volatility and impact
- Automation where possible, people where needed
- Metrics and thresholds defined up front
- Reporting audience and cadence named
- Approved with the SSP, not afterward
- Foundation for ongoing authorization later
Rapid recall: which document
- Control catalog
- SP 800-53
- Baselines
- SP 800-53B
- Assessment procedures
- SP 800-53A
- Categorization
- FIPS 199, SP 800-60
- Minimum requirements
- FIPS 200
- RMF process
- SP 800-37 Rev 2
- CUI contractors
- SP 800-171
- Supply chain
- SP 800-161
Reference strip: baselines, tailoring, families, approval
Baselines
- Low, moderate, high
- Privacy baseline for PII
- Categorization picks the start
Tailoring
- Scope, compensate, parameterize
- Supplement, apply overlays
- Justify and approve every change
Families to spot
- AC, AU, CM, CP, IA
- SC, SI, RA, SA, CA
- PM: no baseline, SR and PT: new
Allocation
- Common: provider owns
- Hybrid: shared, both documented
- System-specific: owner implements
Approval
- SSP with rationale and parameters
- Monitoring strategy attached
- AO or designee signs
- SAOP for privacy selections
Quick exam traps
- Trap: A baseline is the complete set of controls a system needs
- Trap: Tailoring only ever removes controls
- Trap: PM controls appear in the moderate baseline
- Trap: An overlay replaces the need for a baseline
- Trap: Inherited common controls need no review by the inheriting owner
- Trap: SP 800-53A contains the control catalog
- Trap: The monitoring strategy is written after authorization
- Trap: Rev 5 keeps privacy controls in a separate appendix
cybercertprep.com · original revision sheet written from the public body of knowledge