Frameworks and control catalogs, such as NIST Special Publication (SP) 800-53, ISO/IEC 27001 Annex A or the CIS Critical Security Controls, list far more controls than any one system needs. Standards selection, scoping and tailoring are how you turn a generic catalog into the right set of controls for your environment. Done well, they save money, focus effort on real risks and give auditors a clear record of why each control is or is not in place.
Free account
Keep reading for free
Create a free StudyToCert account to read the rest of this lesson: 7 more sections, 6 key terms, a real-world example, an exam tip and self-check questions. Every lesson, lab and practice test is free with an account.