External System Services (SA-9) ensures that when organizations rely on external providers—such as cloud platforms, SaaS applications, or managed services—security and privacy requirements remain enforced and verifiable. For exam readiness, understand that this control extends system boundaries to include the responsibilities of third parties. SA-9 mandates formal agreements that specify control inheritance, monitoring rights, incident notification, and evidence deliverables. The goal is to

Incident Reporting (IR-6) ensures that detected security incidents are promptly communicated to appropriate parties so that response and oversight occur without delay. For the exam, candidates must understand that this control establishes reporting thresholds, timelines, and communication paths based on incident type and severity. Reports typically include event details, affected systems, scope, initial impact assessment, and corrective actions taken. IR-6 supports both internal

Incident Response Plan (IR-8) ensures that organizations maintain a documented, tested, and updated plan guiding all activities related to incident management. For exam readiness, understand that this control formalizes the structure described in IR-4 and IR-6 by defining objectives, roles, communication flows, escalation criteria, and integration with other plans such as contingency and continuity. The plan must specify how incidents are identified, categorized, reported, and remediated

Information Spillage Response (IR-9) focuses on detecting, containing, and remediating incidents where classified, controlled, or otherwise sensitive information is transferred to unauthorized systems or users. For exam purposes, this control requires rapid isolation of affected systems, analysis of exposure scope, and documented cleanup procedures that ensure contaminated environments are sanitized or rebuilt. The intent is to prevent further dissemination, assess potential impact, and

Risk Assessment (RA-3) defines how organizations identify threats, vulnerabilities, and potential impacts to determine the likelihood and magnitude of adverse events. For exam readiness, candidates should understand that RA-3 formalizes risk evaluation by combining asset value, threat capability, vulnerability severity, and control effectiveness into actionable insights. The control ensures that assessments are documented, repeatable, and updated when significant changes occur or at defined

Vulnerability Monitoring and Scanning (RA-5) ensures organizations continuously identify weaknesses in systems, applications, and configurations before adversaries do. For exam purposes, understand that RA-5 is broader than scheduled scans; it encompasses a full lifecycle that ingests threat intelligence, evaluates exposure across on-premises and cloud assets, and tunes discovery methods to evolving technology stacks. A credible RA-5 implementation maintains current asset inventories,

Baseline Configuration (CM-2) establishes the approved, secure starting point for systems and components, defining the specific settings, versions, and controls that must be present before operation. For the exam, recognize that a baseline is not a generic hardening guide; it is a tailored, version-controlled specification mapped to risk tolerance, mission needs, and technology stack. CM-2 requires baselines for operating systems, network devices, applications, and cloud services, including

Configuration Change Control (CM-3) governs how proposed modifications to systems and baselines are evaluated, approved, implemented, and recorded. For exam readiness, understand that CM-3 is the gatekeeper preventing unvetted changes from introducing vulnerabilities or breaking compliance. The control requires a documented process that captures the change description, risk and impact assessment, security review, testing evidence, approval authority, and rollback plan. CM-3 applies to code

Least Functionality (CM-7) requires systems to provide only the capabilities essential to mission needs, removing or disabling unnecessary services, features, roles, and ports. For exam purposes, understand that reducing functionality directly reduces attack surface and operational complexity, improving both security and reliability. CM-7 builds on CM-2 and CM-6 by ensuring that what is not in the baseline stays out of production and that permitted functions are explicitly justified. The

Incident Handling (IR-4) defines how organizations detect, analyze, contain, eradicate, and recover from security incidents in a structured and repeatable manner. For exam purposes, understand that this control operationalizes the entire incident response process by prescribing standard procedures, communication paths, and decision-making authorities. IR-4 ensures incidents are managed consistently across systems, regardless of origin or severity. The control emphasizes preparedness,

Protection of Audit Information (AU-9) ensures that collected logs and audit data remain complete, accurate, and tamper-resistant. For exam readiness, candidates should recognize that audit data often contains sensitive details about system operations, making it a target for attackers seeking to hide traces of intrusion. AU-9 mandates safeguards to restrict access, maintain integrity, and separate audit functions from those being monitored. The goal is to ensure that logs can be trusted as

Audit Record Retention (AU-11) specifies how long organizations must keep audit logs and related records so they remain available for investigations, compliance reviews, and operational analysis. For exam purposes, understand that retention is a risk-based, policy-driven decision influenced by legal, regulatory, contractual, and mission requirements. AU-11 ensures that retention periods are defined, documented, and applied consistently across systems and data types, including applications,

Non-Organizational User Authentication (IA-8) ensures that external users—such as partners, contractors, and customers—are verified before accessing organizational systems or data. For exam purposes, this control recognizes that trust boundaries extend beyond internal staff and must be governed by equivalent assurance standards. IA-8 requires authentication mechanisms that confirm the identity of non-organizational users through approved credentials, federated identity systems, or managed

Identifier Management (IA-4) establishes rules for creating, assigning, and maintaining unique identifiers for all users, devices, and processes that interact with organizational systems. For exam purposes, candidates should understand that identifiers—such as usernames or system IDs—form the foundation of accountability by linking actions to individuals or components. IA-4 ensures that identifiers are unique, traceable, and protected from reuse or unauthorized alteration. The control

Event Logging (AU-2) defines which system activities must be recorded to support accountability, detection, and analysis. For exam readiness, candidates should know that AU-2 requires identifying events significant to security, privacy, and operational assurance—such as logins, privilege changes, data access, and configuration modifications. The control ensures that event selection aligns with mission, risk, and compliance requirements rather than logging indiscriminately. Proper event

Audit Record Review, Analysis, and Reporting (AU-6) focuses on how organizations interpret and act upon the logs collected under AU-2. For exam purposes, candidates must understand that collecting audit records has no value unless those records are analyzed for indicators of compromise, anomalies, or policy violations. AU-6 requires scheduled reviews, automated correlation, and reporting to responsible officials for investigation and response. The control ensures that analysis frequency and

Separation of Duties (AC-5) prevents fraud, error, and unauthorized activity by dividing critical functions among different individuals or roles. On the exam, candidates should recognize that this control enforces checks and balances within processes such as system administration, financial transactions, or access provisioning. No single person should be able to initiate and approve the same action. AC-5 complements least privilege by focusing on function segregation rather than access

Least Privilege (AC-6) enforces that users and processes operate with the minimum access necessary to perform assigned duties. For exam preparation, candidates must know this principle reduces attack surface and limits damage if credentials are compromised. The control applies to all environments—on-premises, cloud, and hybrid—requiring that permissions be granted only for legitimate business needs and reviewed regularly. Privileged accounts receive special scrutiny to ensure elevation is

Identification and Authentication (IA-2) establishes the foundation of trust by ensuring that only verified users gain access to organizational systems. For exam purposes, this control requires that every user be uniquely identified and authenticated before establishing a session or performing an action. Authentication mechanisms can include passwords, multi-factor authentication (MFA), smart cards, or biometrics depending on risk level. The goal is to confirm identity with sufficient

Authenticator Management (IA-5) ensures that credentials—passwords, tokens, keys, or certificates—are created, stored, distributed, and revoked securely. For the exam, candidates should understand that IA-5 defines the lifecycle of authenticators, addressing generation strength, protection during storage and transmission, and prompt revocation when compromised or no longer needed. This control prevents reuse, sharing, or weak credential creation that could undermine authentication