CRISC Domain 1 Practice Exam

In this framework, the second step is all about sizing the system’s security needs by classifying what you have to protect. You determine the security category using standards like FIPS 199, looking at the information types processed, stored, or transmitted and the potential impact if confidentiality, integrity, or availability is compromised. This yields a Low, Moderate, or High impact level for each of those three areas. That categorization sets the baseline for everything that follows: it tells you how strict the controls need to be and which baseline controls to start with in Step 3, guiding subsequent tailoring and implementation. Without this categorization, you wouldn’t know which controls are required or how to calibrate them, so later steps like selecting and implementing controls, assessing them, authorizing the system, and ongoing monitoring wouldn’t be properly aligned. The other activities belong to later stages: implementing controls comes after you’ve decided what’s needed, monitoring occurs after authorization, and authorization happens once the controls are in place and assessed.