Controls based on system security requirements; evaluation criteria (Common Criteria)

Choosing controls should start with requirements, not products. A system's security requirements come from its data classification, business function, laws and contracts, risk assessment and the organization's policies. Once you know what the system must achieve, for example 'only authenticated clinicians can view patient records, and every access is logged', you select controls that meet those requirements and later verify that they do. Starting from a favorite product instead often leaves real requirements unmet while spending money on features nobody needed.