System Compliance

Compiling and submitting compliance documentation, determining system risk posture, and documenting formal compliance decisions.

5 minutes 5 Questions

System Compliance in the context of Certified in Governance, Risk and Compliance (CGRC) refers to the process of ensuring that an organization's information systems, technologies, and IT infrastructure adhere to established laws, regulations, standards, policies, and industry best practices. It is …

Concepts covered

Security and Privacy Documentation Compilation Authorizing Official and Compliance Decision Authority Third-Party Assessment Organizations Residual Risk Determination and Documentation Stakeholder Concurrence for Risk Treatment System Risk Acceptance Criteria Formal Compliance Notification Compliance Decision Documentation and Stakeholder Communication

Test mode:

Exam (Timed)

Practice (With explanations)

Start practice test

CGRC - System Compliance Example Questions

Test your knowledge of System Compliance

Question 1

An organization's CISO must present residual risk findings to the board after implementing controls across three critical systems. One system's residual risk exceeds the approved risk appetite, another falls within tolerance, and the third has residual risk that is borderline. The board must decide on a path forward. Which recommendation best demonstrates sound residual risk evaluation practice?

Recommend accepting all three residual risks after documenting them thoroughly, since the controls have already been implemented and the risk assessment process has been completed per organizational policy Recommend transferring the exceeded risk to a third party through cyber insurance, accepting the borderline risk based on qualitative judgment, and closing the within-tolerance risk from further monitoring cycles Recommend accepting the within-tolerance risk, escalating the exceeded risk for additional mitigation or formal acceptance by an authorizing official, and conducting further quantitative analysis on the borderline system before deciding Recommend implementing additional compensating controls for all three systems to reduce residual risk uniformly, then re-assessing and presenting updated findings to the board at the next quarterly review meeting

Correct Answer: Recommend accepting the within-tolerance risk, escalating the exceeded risk for additional mitigation or formal acceptance by an authorizing official, and conducting further quantitative analysis on the borderline system before deciding

The correct answer demonstrates sound residual risk evaluation by applying differentiated, risk-appropriate responses: accepting risk within tolerance, escalating risk exceeding appetite to proper authority for formal acceptance or further mitigation, and gathering additional data on the borderline case before committing to a decision.

Accepting all three risks simply because controls were implemented ignores that one system exceeds the approved risk appetite, which requires explicit authorization. Transferring exceeded risk via insurance alone does not address the root cause and closing within-tolerance risk from monitoring violates continuous monitoring principles. Applying uniform additional controls to all three systems is inefficient and ignores that one system already falls within tolerance.

The key concept tested is residual risk evaluation aligned with organizational risk appetite and escalation protocols.

Question 2

A security team proposes a high-cost mitigation for an operational system vulnerability. The system owner suggests an alternative control that leaves moderate residual risk to conserve budget. The Authorizing Official must formally approve the system's security posture. On what basis should the ISSO justify the system owner's alternative approach to achieve formal stakeholder concurrence?

By confirming the system owner possesses sufficient administrative authority to override standard security baselines to preserve project funding. By proving the alternative control utilizes the exact same security mechanisms as the original proposal while reducing the financial burden on the department's operational budget allocations. By documenting that the security operations team formally assumes operational liability for the remaining vulnerabilities present in the deployed environment. By demonstrating that the residual risk generated by the alternative control remains within the organization's established risk tolerance thresholds.

Correct Answer: By demonstrating that the residual risk generated by the alternative control remains within the organization's established risk tolerance thresholds.

The correct approach is to justify the alternative control by demonstrating that the resulting moderate residual risk falls within the organization's formally established risk tolerance acceptable to the Authorizing Official.
Claiming the alternative uses the exact same mechanisms is factually incorrect since the resulting residual risk differs. System owners cannot unilaterally override security baselines based solely on budget constraints. Security operations teams do not assume formal operational liability for accepted system risks, as this is the Authorizing Official's responsibility.
The key concept tested is risk tolerance and acceptable residual risk alignment.

Question 3

An organization is setting up a new workflow for finalizing risk treatment decisions on a critical cloud application. The risk management team needs to design the final approval phase to establish formal accountability. How should the team construct this final step to ensure proper executive buy-in?

Develop a comprehensive technical report detailing all mitigated vulnerabilities to be reviewed by the system administrators. Require the primary software developers to formally accept responsibility for the remaining system vulnerabilities. Mandate that the external audit team provide formal certification of the implemented security controls. Draft a formal sign-off document that assigns residual risk ownership to the authorizing official.

Correct Answer: Draft a formal sign-off document that assigns residual risk ownership to the authorizing official.

The correct answer is right because formalizing risk treatment decisions requires the authorizing official to explicitly accept accountability for any residual risk before a system goes live.

Developing a technical report for system administrators is incorrect because administrators do not have the authority to accept organizational risk. Mandating external audit certification is wrong because auditors assess compliance rather than accept operational risk on behalf of the organization. Requiring software developers to accept responsibility is incorrect because developers are not accountable for business risk decisions.

Key concept tested: Risk ownership and accountability in the risk treatment process.

Master Governance, Risk & Compliance

CGRC authorization, risk & continuous monitoring

Authorization Framework: NIST RMF, system categorization, and control selection
Risk Management: Assessment, analysis, and ongoing risk monitoring
Continuous Monitoring: Security control assessment and ongoing authorization
30-Day Money-Back Guarantee: Full refund within 30 days if unsatisfied
Risk-Free: 7-day free trial with all premium features!

Start Your Free 7-Day Trial