Implementation of Security Controls
From plan to practice
Implementation turns selected controls into operating reality. Key concepts include the system security plan, which documents how each control is implemented or why it is not; configuration management, which keeps implementations consistent; and the separation of duties that prevents one person from designing, implementing, and approving the same control. Candidates should know that implementation includes technical, operational, and management controls, and that documentation is itself a control activity.
Evidence and traceability
Every implemented control should leave evidence: configuration settings, logs, procedures, training records, or diagrams. Traceability matters because assessment later depends on artifacts that show the control exists and operates. Implementation also includes updating the system security plan when changes occur, and integrating security into change management rather than bolting it on afterward.
Traps to watch
A common trap is equating a written procedure with an operating control; a procedure that no one follows is not implemented. Another is assuming inherited controls require no local action; the system still must confirm the inherited control is in place and relevant. Watch also for questions that treat implementation as complete once the system goes live, ignoring configuration drift.
Rule of thumb
If it is not documented and observable, it is not implemented. Worked example: a team writes an access review procedure but never performs reviews. During assessment, the assessor finds no review records, so the control fails. The fix is to schedule reviews, retain evidence, and update the system security plan.