Selection of Security Controls
From minimum requirements to a tailored baseline
FIPS 200 establishes minimum security requirements, and SP 800-53 provides the control catalog. SP 800-53B supplies low, moderate, and high baselines. Selection starts with the baseline matching the system category, then applies tailoring: scoping (removing controls that truly do not apply), parameterization (setting organization-defined values), compensating controls (alternative measures when a control cannot be met as written), and supplemental controls (adding controls for specific risk). Overlays-such as privacy, cloud, or national security overlays-adapt the baseline. The final set, with rationale, is documented in the SSP.
Common controls and inheritance
Organizations often provide common controls, such as enterprise identity management or physical security. System owners inherit these but must confirm scope and provider. Hybrid controls are partly common and partly system-specific. Selection should identify which controls are common, hybrid, or system-specific, and should include privacy controls from the PT family where applicable.
Traps
The baseline is a starting point, not the final answer; deleting a control without documented scoping or compensation is a common error. Not applicable still requires justification. Choosing controls is not the same as implementing them, and selecting a control does not prove it exists. Also avoid selecting controls before the category is final.
Worked example
A moderate system's baseline includes a control that the system cannot meet because of a legacy platform. The team documents a compensating control, assesses residual risk, and records both in the SSP. Rule of thumb: select, tailor, justify, and document.