ISC2 Governance, Risk and Compliance (CGRC) Practice Question

In the operations and maintenance phase, every proposed change to a federal information system must undergo configuration management and change control. NIST SP 800-37 Rev. 2 and NIST SP 800-128 state that organizations are required to perform a security impact analysis to determine how the change could affect existing security and privacy controls and overall risk posture. Only after this analysis is completed and any necessary updates to documentation or controls are identified can the organization proceed to seek authorization and schedule installation. Simply updating a POA&M, rushing the patch into production, or decommissioning the component ignores the fundamental requirement to first understand and document the change's effects on the system's authorized security baseline.