Security Control Selection, Tailoring & Baselines (NIST SP 800-53) Flashcards
6 cards from real CAP practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Security Control Selection, Tailoring & Baselines (NIST SP 800-53) flashcards as text
A federal system is categorized as MODERATE impact. Which NIST SP 800-53 security control baseline should be applied as the starting point?
Answer: The MODERATE baseline.
NIST SP 800-53 defines three control baselines (LOW, MODERATE, HIGH) aligned to FIPS 199 impact levels. A MODERATE-categorized system uses the MODERATE baseline as its starting point before any tailoring.
Which tailoring action allows an organization to remove a security control from the baseline because it is not applicable to the system's operating environment?
Answer: Scoping
Scoping involves applying specific guidance to adjust the baseline — including eliminating controls that are not applicable (e.g., removing mobile device controls from a system that has no mobile interfaces). Supplementation adds controls; overlays are community-wide tailoring guidance; compensating controls substitute when a baseline control cannot be implemented.
An organization cannot implement a required NIST SP 800-53 control due to a documented technical constraint. What is the correct approach?
Answer: Implement a compensating control that provides equivalent protection, and document it.
When a required control cannot be implemented, organizations should identify and implement a compensating control that provides equivalent or comparable protection. This must be documented in the Security Plan and approved by the Authorizing Official.
Which of the following best describes a 'security control overlay' in NIST SP 800-53?
Answer: A community-wide tailoring of the security control catalog for a specific technology type, environment, or mission.
Overlays are tailored baselines developed for specific communities of interest (e.g., cloud systems, healthcare, Industrial Control Systems). They adjust the baseline controls to reflect the unique requirements of that environment and are approved for community-wide use.
In NIST SP 800-53, security controls are organized into 'families.' Which control family specifically addresses planning for security activities?
Answer: Planning (PL)
The Planning (PL) family in NIST SP 800-53 includes controls related to security planning activities, such as developing the System Security Plan (SSP) and Rules of Behavior. The PL family is directly relevant to the authorization documentation process.
What is the purpose of 'supplementation' during security control tailoring?
Answer: To add controls beyond the baseline to address residual risks or organizational policies.
Supplementation is the tailoring action of adding controls (or control enhancements) to the baseline to address risks not adequately covered by baseline controls, or to meet specific organizational or mission requirements. It is the opposite of scoping, which removes controls.