Your FREE CGRC Flashcards 2026 – 150+ Cards

The NIST Risk Management Framework — a 7-step process for managing system security and privacy risk (SP 800-37 Rev. 2).

Governance, Risk, and Compliance — directing the organization, managing its risk, and meeting its obligations.

Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor (mnemonic: PCSIAAM).

Setting direction and accountability through policy, oversight, and defined roles.

Meeting legal, regulatory, and contractual obligations.

Identifying, assessing, and treating risk to the organization's mission.

Preserving authorized restrictions on access and disclosure of information.

Guarding against improper modification or destruction; includes authenticity and non-repudiation.

Ensuring timely and reliable access to and use of information.

Assurance that a party cannot deny having taken an action; provided by signatures and logging.

Policy → standard → procedure → guideline (only guidelines are optional).

A high-level management statement of intent and direction; mandatory.

A mandatory, specific requirement that supports a policy (e.g., 'use AES-256').

Detailed step-by-step instructions for carrying out a task; mandatory.

A recommended, discretionary best practice; not mandatory.

Subjective ranking of risk as high, medium, or low; fast but not dollar-based.

Objective, dollar-based risk analysis using SLE, ARO, and ALE.

Single Loss Expectancy = Asset Value × Exposure Factor (loss from one event).

The percentage of an asset's value lost if a specific risk event occurs.

Annualized Rate of Occurrence — the expected number of events per year.

Annualized Loss Expectancy = SLE × ARO (the expected yearly cost of a risk).

A control whose annual cost is less than the reduction in ALE it provides.

The likelihood a threat exploits a vulnerability, and the resulting impact on an asset.

Any potential event or actor that could harm an asset by exploiting a vulnerability.

A weakness in a system, process, or control that a threat can exploit.

The broad amount and type of risk an organization will accept to pursue value (strategic).

The level of risk variation an organization will accept in practice (operational).

The NIST Cybersecurity Framework — a voluntary framework to manage and reduce cyber risk.

The standard for an Information Security Management System (ISMS).

The standard for enterprise / organizational risk management.

A framework for IT governance aligned to business objectives.

Standardized security authorization for cloud services used by U.S. federal agencies.

The Payment Card Industry Data Security Standard for protecting cardholder data.

Cybersecurity Maturity Model Certification for the U.S. defense industrial base.

The Federal Information Security Modernization Act — drives federal security requirements.

U.S. law protecting the privacy and security of health information.

The EU General Data Protection Regulation governing personal-data processing.

System Development Life Cycle — requirements, design, development, testing, operations, disposal.

How data is created, used, stored, retained, and disposed of by type.

ISC2's Certified in Governance, Risk and Compliance — the renamed Certified Authorization Professional.

Protecting personal information; woven throughout every domain of the 2024 outline.

Everything in a system for authorization: people, processes, hardware, software, data, and connections.

The documented name, purpose, functionality, and boundary of the system to be authorized.

A category of information (e.g., financial, medical) with its own impact to C, I, and A.

The standard for categorizing a system's potential impact (Low/Moderate/High) on C, I, and A.

RMF step 2: determine the system's impact level using FIPS 199.

The overall system category equals the HIGHEST impact across C, I, and A — never the average.

A compromise would have a limited adverse effect on operations, assets, or individuals.

A compromise would have a serious adverse effect.

A compromise would have a severe or catastrophic adverse effect.

NIST guide that maps information types to provisional impact levels.

Data Protection Impact Assessment — evaluates privacy risk of processing personal data.

Confidentiality, integrity, or availability — each rated separately during categorization.

The categorization standard used for National Security Systems.

Inflates cost and complexity and over-scopes the authorization.

Leaves real risk unaddressed and outside the authorization.

Assessing the potential harm to C, I, and A to set the system's category.

Categorization drives which baseline, how much assurance, and what the AO accepts risk for.

RMF step 3: choose and tailor the control set based on the system's categorization.

FIPS 199 → FIPS 200 → pick the 800-53B baseline → tailor it.

The standard for the minimum security requirements that correspond to an impact level.

A predefined Low/Moderate/High starting control set in SP 800-53B — a starting point, not a fixed minimum.

The NIST publication that defines the Low, Moderate, and High control baselines.

The catalog of security and privacy controls, organized into 20 control families.

A group of related controls (e.g., AC Access Control, AU Audit, SC System & Communications).

Adjusting a baseline: scoping, parameterizing, supplementing, overlays, and compensating controls.

Removing controls from a baseline that genuinely do not apply to the system.

A fully specified set of control adjustments tailored to a community, technology, or mission.

A control provided once at the organization level and inherited by many systems.

An alternative safeguard providing equivalent protection when the baseline control isn't feasible.

A control implemented partly as a common control and partly as system-specific.

When a system receives protection from controls developed and assessed by another entity.

A safeguard to ensure compliance with privacy requirements and manage privacy risk.

The control baseline for a low-impact system (about 150 controls).

The control baseline for a moderate-impact system (about 300 controls).

The control baseline for a high-impact system (about 390 controls).

SP 800-53 Rev. 5 organizes its controls into 20 families (AC, AU, SC, IA, and so on).

The baseline is tailored, not adopted unchanged — it is not a mandatory minimum set.

RMF step 4: deploy the selected controls and document HOW each is implemented.

System Security Plan — the master document describing the system and how every control is implemented.

The System Owner develops and maintains the System Security Plan.

The plan for resourcing, funding, timeline, and measuring control effectiveness.

A control implemented through policy, planning, and risk management (e.g., a risk assessment).

A control executed by people and procedures (e.g., training, incident response).

A control enforced by technology (e.g., encryption, access control, audit logging).

A control that stops an incident before it happens (e.g., access control, encryption).

A control that identifies an incident in progress or after it occurs (e.g., logging, IDS).

A control that restores a system after an incident (e.g., backups, patching).

A control that discourages a threat actor (e.g., warning banners, visible cameras).

Recording purpose, scope, and how each control is implemented in policies, procedures, and the SSP.

A substitute deployed when the prescribed control cannot be implemented as written.

Controls must be implemented consistent with the organization's compliance obligations.

How often implemented controls, documentation, and training are reviewed and refreshed.

NIST guide for developing System Security Plans (the SSP).

Implementation of Controls is the largest CGRC domain at 17% of the exam.

A technical control protecting confidentiality of data at rest and in transit.

An operational control reducing human-error risk across the organization.

Inherited common controls are not reimplemented per system — they're inherited once.

RMF step 5: determine whether controls are implemented correctly and working as intended.

Security Control Assessor — independently assesses and tests controls and writes the SAR.

The assessor must be independent of the System Owner to keep the assessment objective.

Security Assessment Plan — defines the scope, roles, evidence, and procedures for the assessment.

Examine, Interview, Test (EIT) — defined in SP 800-53A.

Reviewing documents, policies, and configurations to assess a control.

Questioning the people who operate a control to assess it.

Exercising a control to see how it behaves (e.g., a vulnerability scan or penetration test).

NIST guide for assessing security and privacy controls (the assessment procedures).

Security Assessment Report — the assessor's findings and recommendations.

A SAR status meaning the control is implemented correctly and works as intended.

A SAR status meaning the control has a weakness or gap; it flows into the POA&M.

A SAR status meaning the control does not apply to the system; document the justification.

Plan of Action and Milestones — tracks unresolved weaknesses, owner, resources, and target dates.

The System Owner owns and maintains the POA&M.

How a risk is treated: avoid, accept, mitigate (reduce), or transfer/share.

Eliminating a risk by ceasing the activity that creates it.

Reducing risk to an acceptable level by implementing controls.

Shifting the financial impact of a risk to a third party (e.g., insurance).

A documented, management-approved decision to tolerate a risk and its residual impact.

The risk that remains after controls are applied; the AO formally accepts it.

Transferring a risk's financial impact never transfers your accountability or liability.

An authorized, simulated attack that exploits weaknesses to show real impact.

An automated check that finds known weaknesses without exploiting them.

Documents final compliance per control: compliant, non-compliant, or not applicable.

RMF step 6: a senior official makes a risk-based decision to authorize the system.

The SSP, SAR, and POA&M submitted to the Authorizing Official for the decision.

Authorizing Official — the senior official who accepts residual risk and signs the ATO.

The Authorizing Official is the only role that can authorize a system to operate.

AO Designated Representative — coordinates the process but cannot make or sign the decision.

Responsible for the system; develops the SSP, owns the POA&M, submits the authorization package.

Information System Security Officer — handles the day-to-day operational security of a system.

Information System Security Manager — manages ISSOs, aggregates risk, advises the AO.

Information System Security Engineer — builds security into the system's design.

Supplies the inherited common controls used across many systems.

Sets requirements for how its information is handled; involved in categorization.

Provides an organization-wide risk perspective to keep system decisions consistent.

The separation rule: the assessor evaluates controls; the AO accepts the risk.

Authorization to Operate — the AO's formal decision to operate and accept residual risk.

Authorization to operate provided specific weaknesses are remediated on a schedule.

Denial of Authorization to Operate — the risk is unacceptable; the system may not operate.

Interim Authority to Test — permits testing in an operational setting, NOT production operation.

An IATT authorizes testing only; only an ATO authorizes production operation.

Authorization is a judgment about residual risk, never a purely technical pass/fail.

The thresholds the AO uses to decide whether residual risk is acceptable.

Agreement from relevant parties on the risk treatment before the compliance decision.

Mutual agreement to accept another organization's assessments and security posture.

Third-Party Assessment Organization — independent assessor used in programs like FedRAMP.

RMF step 7: continuously monitor control effectiveness and risk after authorization.

Ongoing awareness of security, vulnerabilities, and threats to keep risk decisions current.

NIST guide for Information Security Continuous Monitoring (ISCM).

Keeping authorization current through continuous monitoring, not periodic reauthorization.

Defines what to monitor, how often, and the metrics that trigger action.

The controlled process to evaluate, approve, implement, and track system changes.

Evaluating how a proposed change affects the security state before approval.

Change Control Board — approves, defers, or rejects proposed changes to a system.

A documented way to reverse a change if it fails or harms security.

A change large enough to trigger reassessment and possibly reauthorization.

Securely retiring a system at end of life, including media sanitization and documentation.

Removing data from media (clear, purge, or destroy) so it cannot be recovered.

Re-checking control effectiveness over time as part of continuous monitoring.

Authorization is a lifecycle; continuous monitoring feeds ongoing authorization decisions.

Controlling and documenting the configuration of an authorized system (SP 800-128).

Detecting, responding to, and learning from incidents during operations.

Plans to keep or restore operations after a disruption (continuity and recovery).

Gathering ongoing documentation and test results to demonstrate continued compliance.

Updating the ISCM strategy as laws, regulations, or suppliers change.

An approved, documented set of system settings used as a reference for changes.