Selection and Approval of Framework, Security, and Privacy Controls
The third domain tests control selection and the approval that legitimizes it: choosing a framework, selecting and tailoring a baseline, and getting the AO to approve the resulting set before implementation.
Framework and baseline selection
- The framework is the organized set of controls and assessment guidance the organization adopts - most commonly the NIST RMF with SP 800-53 Rev. 5 controls and SP 800-53B baselines.
- FIPS 200 establishes minimum security requirements; 800-53B maps low, moderate, and high baselines to the FIPS 199 categorization.
- Rev. 5 added the PT (privacy) family, so privacy controls are selected alongside security controls rather than added later.
- Overlays add or strengthen controls on top of a baseline for a community, sector, or mission; CNSSI 1253 for national security systems is the classic example.
Tailoring and approval
Tailoring must be documented, not improvised. It covers scoping (removing controls that genuinely do not apply, with justification), parameterization (assigning organization-defined values such as review frequency), compensating controls (an alternative giving equivalent protection when a baseline control cannot be met), and supplemental controls driven by risk assessment. The system owner and ISSO propose the tailored set in the SSP; the AO approves the security plan and thereby the control set, while common control providers approve what they will supply.
Worked example
A moderate-impact system sits in a commercial facility where the agency cannot control physical entry. The team does not simply delete PE-3. It documents the facility's controls, records the dependency as an inherited/compensating arrangement, adds a requirement for provider audit reports, and parameterizes the PE-3 review frequency. The AO approves the plan with that reasoning visible, and the SCA later assesses against the approved set rather than an off-the-shelf baseline.
Traps that cost marks
- Treating the moderate baseline as mandatory in full, with no documented tailoring.
- Scoping out a control because it is inconvenient rather than inapplicable.
- Parameterizing controls without recording the chosen values, leaving nothing to test.
- Selecting security controls while forgetting the privacy family and PIA obligations.