Certified in Governance, Risk and Compliance (CGRC) — Lesson 2: Control Baselines, Tailoring, Approval, Implementation, and Evidence

Learning Objectives

• Distinguish the roles, assumptions, and evidence associated with control baseline selection, tailoring decisions, and control approval.
• Apply implementation planning and evidence traceability while completing a controlled tailor a baseline and map each control to implementation owners and evidence sources.
• Defend a decision about which controls, enhancements, inheritance claims, and compensating measures are justified using risk, operational, and governance considerations.

Detailed Topics

• Challenge control baseline selection with a realistic misuse, failure, or change condition before accepting the result.
• Document tailoring decisions with ownership, evidence, review criteria, and a clear next action.
• Trace control approval from business need to technical implementation and retained assurance evidence.
• Evaluate implementation planning against policy, risk appetite, architecture constraints, and measurable acceptance criteria.
• Use evidence traceability to resolve a course-specific decision and record why rejected options were not selected.

Instructor Demonstration

A guided demonstration traces the scenario from initial evidence to an approved conclusion. Learners observe how tailor a baseline and map each control to implementation owners and evidence sources, how competing options are ruled out, and how the tailored control baseline and implementation evidence index records the final rationale.

Hands-On Exercise

Use the course scenario to tailor a baseline and map each control to implementation owners and evidence sources, then submit a reviewable tailored control baseline and implementation evidence index.

1. Inventory the facts, assets, stakeholders, constraints, and evidence relevant to control baseline selection.
2. Perform the core analysis for tailoring decisions and control approval, recording assumptions and rejected options.
3. Introduce the adverse condition where controls are marked complete using policy statements that do not demonstrate technical or procedural operation and revise the proposed response.
4. Complete the tailored control baseline and implementation evidence index with ownership, acceptance criteria, residual concerns, and the next review date.

Scenario Analysis

• Identify which assumption has the greatest effect on which controls, enhancements, inheritance claims, and compensating measures are justified.
• Compare two viable approaches involving implementation planning and explain their security and operational trade-offs.
• Specify the evidence required before the tailored control baseline and implementation evidence index can be accepted.

Troubleshooting Guidance

Separate symptoms from causes by tracing the decision back through inputs, trust assumptions, implementation evidence, and stakeholder responsibilities. Do not close the issue until the scenario in which controls are marked complete using policy statements that do not demonstrate technical or procedural operation has been reproduced or ruled out.

Validation Checklist

• The scope and ownership for control baseline selection are explicit and agreed.
• The selected treatment for tailoring decisions is supported by scenario evidence rather than assumption.
• The exception involving controls are marked complete using policy statements that do not demonstrate technical or procedural operation was tested and its impact was recorded.
• The tailored control baseline and implementation evidence index identifies acceptance criteria, residual risk, responsible owners, and follow-up actions.

Lesson Outcome

Learners can apply Control Baselines, Tailoring, Approval, Implementation, and Evidence, explain which controls, enhancements, inheritance claims, and compensating measures are justified, and support the conclusion with a reviewable tailored control baseline and implementation evidence index.