CASp common mistakes
CASp · Understand the traps and how to avoid them.
When categorizing a system, the candidate assigns the overall impact label by averaging or by choosing the middle value across confidentiality, integrity, and availability instead of taking the high-water mark.
The candidate carries over a habit of balancing trade-offs or assumes a 'moderate on average' label is defensible, and the scenario is written so that two objectives are low and one is high, which tempts a compromise answer.
What to do instead
State explicitly that the system's overall categorization is the highest impact value among the three objectives, then justify each objective separately against the criteria before combining. Practice by writing the three individual provisional labels first, then deriving the overall label mechanically from the maximum.
The candidate treats the impact of a loss as dependent on the likelihood of the threat occurring, downgrading a category because the threat is considered unlikely.
Risk thinking bleeds into categorization, and candidates who have studied risk assessment instinctively multiply likelihood by impact, which is correct for risk but wrong for categorization.
What to do instead
Separate the two steps verbally: categorization is a function of the potential impact of a loss event on the organization, independent of how probable that event is. Reserve likelihood for the risk assessment step and note in the answer that probability is deliberately excluded from categorization.
The candidate selects controls by copying a baseline wholesale without tailoring, and fails to document the rationale for any scoping or supplemental decisions.
Baselines feel authoritative and complete, so candidates equate 'using the baseline' with 'doing selection', skipping the tailoring and justification steps that the exam treats as the substance of the activity.
What to do instead
Show the tailoring chain explicitly: start from the applicable baseline, apply scoping considerations, identify any controls that are not applicable with a reason, add any supplemental controls driven by the specific environment, and state where the decisions and rationale are recorded.
The candidate confuses control selection with control assessment and describes testing, examining, or interviewing as part of choosing controls.
The lifecycle phases use similar vocabulary, and candidates who memorize control families without mapping them to phases blur selection and assessment into one activity.
What to do instead
Anchor each phase to its output artifact: selection produces a tailored, documented set of controls; implementation produces the controls in operation; assessment produces findings and evidence. When a question asks about choosing controls, exclude any answer whose verbs are test, examine, or verify.
The candidate treats common controls and inherited controls as if they must be re-implemented or re-assessed by the system owner in full.
Candidates reason from a single-system mindset and miss that shared infrastructure controls are provided by another organizational entity, so they overstate the system owner's implementation burden.
What to do instead
Identify which controls are common, hybrid, or system-specific before answering, and state that the system owner inherits common controls, implements only the system-specific portion of hybrid controls, and relies on the provider's assessment evidence rather than duplicating it.
The candidate answers implementation questions by naming a policy document or a plan as the implementation of a control.
Documentation artifacts are easy to recall and sound authoritative, so candidates substitute 'a policy exists' for 'the mechanism is operating', which is exactly the gap the exam probes.
What to do instead
For every implementation answer, describe the mechanism, the responsible role, and the evidence that it operates, such as configuration settings, logs, or automated enforcement. If an answer option only produces a document, treat it as a distractor unless the control itself is documentary in nature.
The candidate describes assessment as a pass or fail judgment on the whole system rather than determining control effectiveness with defined methods and evidence.
Everyday use of the word assessment implies grading, and candidates default to a compliance verdict instead of the examine, interview, and test methods that produce an effectiveness determination.
What to do instead
Frame assessment answers around three elements: the method used, the evidence collected, and the resulting determination of satisfied or other than satisfied with an explanation. Avoid answers that declare the system secure or compliant without stating how effectiveness was determined.
The candidate treats the authorization decision as automatic once assessment findings are known, or assumes a zero-finding result is required before an authorization can be granted.
Candidates conflate assessment with authorization and believe that any residual risk blocks approval, so they choose answers that either skip the authorizing official's judgment or demand remediation of every finding first.
What to do instead
State the sequence explicitly: assessment produces findings, the authorizing official weighs those findings together with the plan of action and milestones and the organization's risk tolerance, and may authorize with conditions. Emphasize that the decision is a risk acceptance by a designated official, not a technical verdict.
The candidate assigns the authorization decision to the security assessor, the system owner, or the information security team instead of the designated authorizing official.
Roles overlap in small organizations and candidates default to whoever is most technical or most senior in the scenario, missing that accountability for risk acceptance sits with a specific authorizing role.
What to do instead
Memorize the role boundaries: the system owner supports and prepares artifacts, assessors evaluate and report, and the authorizing official accepts risk and signs the authorization. When a question names a role, check whether that role has the authority to accept risk before choosing it.
The candidate designs continuous monitoring as a periodic full reassessment or as a one-time report, rather than an ongoing program with defined metrics, frequencies, and response actions.
Continuous monitoring sounds like repeating the initial assessment, and candidates lack a concrete model of what is monitored, how often, and what happens when a threshold is crossed.
What to do instead
Describe continuous monitoring as a strategy with specific elements: what is monitored such as configuration changes, vulnerability results, and control effectiveness; the frequency for each; the thresholds that trigger action; and the reporting path to the authorizing official. Include the requirement to update the authorization when changes materially affect risk.