Study guide
4.1 Developing the Implementation Strategy: Resourcing, Funding and Timeline
ISC2 Certified in Governance, Risk and Compliance CGRC
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
0.1 ISC2 CGRC Exam Structure, Logistics & Passing Strategy 0.2 NIST RMF 7-Step Lifecycle & GRC Architecture
2 Chapter 1: Security and Privacy Governance, Risk Management, and Compliance Program
1.1 Enterprise Governance & GRC Frameworks 1.2 Security and Privacy Objectives: CIA, Non-Repudiation and Privacy Concepts 1.3 Multi-Tier Risk Management & Assessment Methodologies 1.4 System Development Life Cycle and Information Life Cycle Management 1.5 Establishing and Operating the Compliance Program 1.6 Legal, Regulatory & Federal Compliance Drivers 1.7 Privacy Governance, Organizational Roles & ISC2 Code of Ethics
3 Chapter 2: Scope of the System
2.1 System Boundary Definition, Architectural Context & Types 2.2 Identifying Information Types with NIST SP 800-60 2.3 System Categorization Process & Impact Analysis (FIPS 199 / SP 800-60) 2.4 Impact and Risk Determination Under Non-Federal Frameworks 2.5 System Registration, Environment & Interconnection Agreements
4 Chapter 3: Selection and Approval of Framework, Security, and Privacy Controls
3.1 Control Catalogs & NIST SP 800-53 Rev. 5 Structure 3.2 Control Allocation & Inheritance Models 3.3 Control Tailoring, Scoping & Overlay Guidance 3.4 Data Handling and Marking Requirements 3.5 Documenting Control Selection and Securing Stakeholder Agreement 3.6 Continuous Monitoring Strategy & Control Selection Approval
5 Chapter 4: Implementation of Security and Privacy Controls
4.1 Developing the Implementation Strategy: Resourcing, Funding and Timeline 4.2 Identifying Control Types: Management, Operational, Technical and Functional Classes 4.3 System Security and Privacy Plan (SSP/SSPP) Development 4.4 Security Engineering Principles & Technical Control Implementation 4.5 Secure Baseline Configuration & System Hardening 4.6 Implementing Compensating and Alternate Controls 4.7 DevSecOps, SDLC Integration & Supply Chain Risk Management 4.8 Documenting Control Implementation: Policies, Procedures, Plans and Risk Registers
6 Chapter 5: Assessment/Audit of Security and Privacy Controls
5.1 Security Assessment Plan (SAP) & Assessor Independence 5.2 Assessment Methods, Objects & Depth/Coverage 5.3 Assessment Execution, Vulnerability Scanning & Testing 5.4 Preparing the Initial Assessment/Audit Report 5.5 Selecting Risk Responses: Avoid, Accept, Share, Mitigate, Transfer 5.6 Stakeholder Collaboration, Corrective Action and Reassessment 5.7 Security Assessment Report (SAR) & Risk Findings Analysis 5.8 Developing the Risk Response Plan: Prioritization and Resources
7 Chapter 6: System Compliance and Authorization
6.1 The Core Authorization Package & Supporting Artifacts 6.2 Plan of Action and Milestones (POA&M) Architecture & Management 6.3 System Risk Acceptance Criteria and Stakeholder Concurrence 6.4 Authorization Decision Process & Decision Types 6.5 Residual Risk Acceptance, Terms of Authorization & Continuous ATO 6.6 Documenting and Communicating the Compliance Decision
8 Chapter 7: Compliance Maintenance and Continuous Monitoring
7.1 Continuous Monitoring Strategy & Operations (NIST SP 800-137) 7.2 Configuration Management & Security Impact Analysis (NIST SP 800-128) 7.3 Incident Response and Contingency Activities in Sustained Compliance 7.4 Awareness, Training, Evidence Collection and Monitoring-Strategy Revision 7.5 Ongoing Remediation, POA&M Sustainment & Annual Reviews 7.6 Event-Driven Reauthorization & System Decommissioning
4.1 Developing the Implementation Strategy: Resourcing, Funding and Timeline
Key Takeaways Explain This Topic AI
An implementation strategy sequences controls by risk reduction and technical dependency rather than by control identifier order.
Resource planning must cover financial, personnel, and technical resources, since a funded control with no qualified operator is not an implemented control.
Foundational controls such as identity, logging, and configuration management must precede the controls that depend on them.
The organization must establish defined frequencies for compliance documentation reviews and for security and privacy training, because undated obligations are not auditable.
Effectiveness measures are defined during strategy development so that implementation can be judged against a stated criterion rather than declared complete by assertion.
Last updated: August 2026
Developing the Implementation Strategy: Resourcing, Funding and Timeline
CGRC task 4.1 names four dimensions explicitly — resourcing, funding, timeline, effectiveness . Domain 4 carries the heaviest weight on the exam at 17% , and this task is the reason: it is where a paper baseline becomes a funded, scheduled, staffed programme of work. A control set that is perfectly selected and never resourced produces nothing but POA&M entries.
1. Sequencing: Dependency Before Identifier Order
The most common implementation failure is working through the control catalog in identifier order — AC, then AT, then AU — because that order has no relationship to how systems are actually built. Controls have technical dependencies , and implementing a dependent control before its foundation produces rework.
Wave Controls Why It Must Come First
1. Foundation IA-2/IA-5 (identity, authenticator management), AU-2/AU-3 (audit events and content), CM-2 (baseline configuration), CM-8 (component inventory) Nearly everything else depends on knowing what exists, who is acting, and what the approved state is
2. Protection AC-2/AC-3/AC-6 (accounts, enforcement, least privilege), SC-7 (boundary protection), SC-8/SC-28 (transmission and storage protection) Access decisions require an identity source; least privilege requires an account model
3. Detection & Response SI-4 (system monitoring), AU-6 (audit review and analysis), IR-4 (incident handling) Monitoring requires log sources; incident response requires detection
4. Assurance & Sustainment CP-4 (contingency testing), CA-7 (continuous monitoring), AT-2/AT-3 (training) These verify and sustain everything built above
Least privilege (AC-6) cannot be meaningfully implemented before an account management model (AC-2) exists. Audit review (AU-6) has nothing to review until audit generation (AU-3) produces records. Sequencing by dependency eliminates a whole category of avoidable rework.
Prioritize by Risk Reduction, Not by Ease
Within a wave, sequence by risk reduction per unit of effort . Controls addressing high-likelihood, high-impact exposure on internet-facing components come before controls addressing theoretical risk on isolated components. The failure mode the exam tests is a team that implements the twenty easiest controls first to show progress, leaving the highest-risk gaps open longest — a strategy that looks productive on a status report and leaves the actual risk untouched.
Important
Controls that will not be ready by authorization are not omissions — they are planned items. They belong in the initial POA&M with a scheduled completion date, resources, and milestones, and the resulting residual risk is presented to the Authorizing Official as part of the authorization decision. Silently deferring a control is a finding; documenting it as a scheduled item with accepted interim risk is normal governance.
2. The Three Resource Types
The blueprint returns to resourcing again in Domain 5 (task 5.6), and both places use the same triad. Planning only for money is the classic gap.
Resource Includes Typical Failure
Financial Licences, hardware, professional services, assessment costs, recurring subscription and support Funding acquisition but not the recurring operating cost, so the control lapses at renewal
Personnel Engineering effort to build, operational staff to run, specialist skills, and the time of people whose main job is something else Buying a SIEM with no analysts to triage its alerts — a tool that generates unread alerts is not a detective control
Technical Infrastructure capacity, network paths, storage for log retention, test environments, integration interfaces Enabling verbose audit logging without provisioning storage for the mandated retention period
Federal funding has a life cycle of its own. Security requirements must enter the capital planning and investment control process during the budget cycle that precedes the work — typically a year or more ahead. A control identified after the budget is set generally waits for the next cycle unless it can be funded from operating reserves, which is precisely why late discovery of a control requirement is so costly. This is the concrete mechanism behind the general principle that early life-cycle integration is cheaper.
3. Establishing Review and Training Frequencies
The third bullet of task 4.1 requires that frequency be established for compliance documentation reviews and training . An obligation with no stated interval cannot be assessed — the assessor has no criterion against which to judge timeliness — so undated obligations reliably become findings.
Obligation Typical Frequency Anchor Control
Policy and procedure review (the -1 control in each family) Annually, plus on significant change AC-1, AU-1, CM-1, …
- System Security Plan review and update Annually, plus on significant change PL-2
- Security and privacy awareness training On hire, then annually AT-2
- Role-based training for privileged and security roles On assignment, then annually AT-3
- Incident response training and testing Annually IR-2, IR-3
- Contingency plan training and testing Annually (test scope varies by impact level) CP-3, CP-4
- Account review and recertification Commonly quarterly for privileged accounts AC-2
- Control assessment per the monitoring strategy By control volatility CA-7
Two rules govern these values. First, where a regulation, overlay, or organizational policy prescribes a frequency, that value is used — it is not a local judgment call. Second, the frequency is an organization-defined parameter recorded in the SSP , which means it simultaneously creates the obligation and defines the assessment objective. "Reviewed periodically" is unassessable; "reviewed at least annually" is testable.
Note
Significant change is a second trigger, not a replacement for the interval. Nearly every review obligation is phrased as "at least annually and whenever a significant change occurs." Teams that treat change-driven review as a substitute for the calendar interval fail the control on the calendar criterion.
4. Defining Effectiveness Before You Begin
The word effectiveness in task 4.1 is doing real work. A control is not complete when it is installed; it is complete when it is implemented correctly, operating as intended, and producing the desired outcome — the same three-part standard SP 800-53A applies at assessment. Defining that criterion during strategy development means the implementation team builds toward the standard the assessor will apply, instead of discovering the gap at Step 4.
For each significant control, the strategy should state:
The outcome the control is meant to produce ("privileged access is granted only to currently authorized personnel").
The measure that demonstrates it ("percentage of privileged accounts with a current, approved authorization record").
The evidence that will be produced, and where it will be retained.
The threshold that distinguishes effective from deficient.
This is also how the continuous monitoring strategy gets its metrics. Controls whose effectiveness measure is automatically computable become continuously monitored; controls requiring manual evidence gathering are assessed on a defined interval. Deciding this at strategy time rather than at Step 6 avoids retrofitting instrumentation into systems that were never built to emit it.
Communicating the Strategy
The implementation strategy is a coordination artifact as much as a plan. Engineering teams need the sequence and dependencies; the business owner needs the timeline and any operational impact; the Authorizing Official needs to know which controls will be deferred and what interim risk that creates; the Security Control Assessor needs to know when components will be ready for assessment. Publishing the strategy is what prevents the most avoidable schedule failure in the RMF — an assessment scheduled against a system whose controls are not yet in place.