Selection and Approval of Security and Privacy Controls
From baseline to approved set
Selection starts with the NIST SP 800-53B baseline for the system's FIPS 199 category, adds the privacy baseline when PII is processed, and then tailors. Tailoring has four recognized moves: scoping (a control genuinely does not apply because of technology or architecture), parameterization (setting organization-defined values), compensating controls (an alternative providing equivalent protection), and supplementation (adding controls beyond the baseline for extra risk). Overlays - community- or mission-specific packages - adjust the baseline further. The output is documented in the security plan with a rationale for every change, and the AO approves the plan and therefore the control set.
Traps
Tailoring is not deleting. A question that shows controls removed with no justification is describing an error. Compensating controls must provide equivalent protection and must be documented and approved, not merely asserted. Do not confuse selection with implementation: choosing a control is a planning act, implementing it is the next step, and assessing it comes after that. Also watch for "the ISSO approved the control set" - approval belongs to the AO, with the system owner proposing.
Rule of thumb
Every deviation from the baseline should answer three questions in writing: what was removed or changed, why, and who accepted the resulting risk. If the paperwork cannot answer all three, the tailoring is not complete.
Worked example
A moderate-impact system has no wireless capability, so the wireless access control is scoped out with a documented rationale - valid tailoring. The same system drops audit review because "the team is small" - invalid, because that is a resourcing excuse, not an architectural fact.