Selection of Security Controls
Baseline and tailoring
Control selection begins with a baseline appropriate to the system's category, then applies tailoring: scoping out controls that do not apply, compensating for controls that cannot be implemented as written, and supplementing with additional controls. The result is documented in the system security plan. Candidates should understand that a baseline is a starting point, not a mandatory checklist, and that justification for tailoring must be recorded.
Control families and structure
Know that controls are organized into families, each with a base control and optional enhancements. Enhancements add rigor for higher-impact systems. Selection must also consider common controls inherited from the organization, which are documented once and referenced by the system rather than re-implemented.
Traps to watch
Questions often imply that selecting a control guarantees it is effective; selection is only a decision, and assessment verifies implementation. Another trap is treating inherited controls as untested or undocumented. A third is confusing compensating controls, which provide equivalent protection, with scoping, which removes a control as not applicable. Also watch for the assumption that higher baselines always require every enhancement.
Rule of thumb
Select for the category, tailor for the mission, and document every deviation. Worked example: a moderate system inherits physical access controls from a shared facility. The system security plan references the common control, the facility's assessment evidence is reused, and the system does not duplicate the control. If a required control cannot be met, the team documents a compensating control and the residual risk for the AO.