Scope of the System

Defining system purpose, functionality, boundaries, and determining security compliance requirements based on risk impact levels.

5 minutes 5 Questions

In the context of Certified in Governance, Risk and Compliance (CGRC), the Scope of the System refers to the clearly defined boundaries and extent of an information system or authorization boundary that is subject to governance, risk management, and compliance processes. It is a critical component …

Concepts covered
System Purpose and Functionality DocumentationSystem Name and Scope DocumentationRisk Impact Level DeterminationSecurity Objectives for Information TypesFIPS and Federal Information Processing StandardsInformation Type ClassificationISO/IEC Security Compliance RequirementsData Protection Impact Assessment
Test mode:
Start practice test

CGRC - Scope of the System Example Questions

Test your knowledge of Scope of the System

Question 1

An organization holds ISO/IEC 27001 certification and has recently migrated its infrastructure to a new cloud provider. The information security management system (ISMS) scope statement still references the previous on-premises data center. A surveillance audit is scheduled in three months. What should the organization prioritize to maintain compliance?

Correct Answer: Update the ISMS scope and conduct a risk assessment reflecting the new cloud environment before the audit

ISO/IEC 27001 requires that the ISMS scope accurately reflects the organization's context, and any significant change such as a cloud migration necessitates updating the scope statement and performing a corresponding risk assessment to ensure controls remain appropriate for the new environment before the surveillance audit.

Postponing the surveillance audit is unnecessary and could itself jeopardize certification standing. Retaining the outdated scope misrepresents the organization's actual infrastructure, which would be a nonconformity during audit. Updating the Statement of Applicability and obtaining a SOC 2 report are useful steps but do not substitute for formally revising the ISMS scope, which is the foundational requirement.

Key concept tested: ISMS scope maintenance and risk reassessment following significant organizational changes under ISO/IEC 27001.

Question 2

A company is launching a new health tracking app for its staff. Management wants to ensure compliance with regulations regarding sensitive medical records. The development team needs to know the optimal timing to evaluate the risks to personal information. At what point in the software lifecycle should the team conduct the assessment?

Correct Answer: During the initial planning and conceptualization stages of the application development.

Conducting a privacy impact assessment during the initial planning stages ensures that privacy controls are integrated into the fundamental design of the application, adhering to the principle of privacy by design.
Waiting until coding begins misses the opportunity to build security into the foundational architecture. Performing the assessment after user testing is far too late and makes remediation highly expensive. Conducting it during the handover to operations ignores the proactive nature of risk management and delays necessary compliance checks until the product is already finished.
The key concept tested is privacy by design within the software development life cycle.

Question 3

What best describes the fundamental relationship between an information type and the security objectives within federal risk management?

Correct Answer: The categorization designates specific potential impact values to the core security triad elements based on specific mission requirements and statutory guidelines.

The correct answer accurately reflects that identifying an information type is fundamentally about assigning potential impact levels to confidentiality, integrity, and availability based on federal directives.

The choice focusing on technical controls is incorrect because impact levels guide control baselines rather than dictating exact mechanisms. The choice regarding physical facility roles is wrong as information types do not establish personnel responsibilities. The choice citing continuous monitoring is incorrect because information types define impact, not specific monitoring or incident handling protocols.

The key concept tested is the federal categorization of information types and security objectives.

More Scope of the System questions
213 questions (total)
Practice 100 questions
One session at a time, always new questions