Selection and Approval of Framework, Security, and Privacy Controls
Frameworks are catalogs; baselines are starting points
Common sources include NIST SP 800-53 with its 800-53B baselines, ISO/IEC 27001 Annex A, the NIST Cybersecurity Framework, CIS Controls, PCI DSS, and sector schemes. Select based on legal, regulatory, and contractual obligations plus mission and risk - not on familiarity or vendor preference. Document why the framework was chosen.
Tailoring is a documented activity
Begin with the baseline matching the categorization, then tailor:
- Scoping - remove controls that genuinely do not apply (e.g., a control for wireless where no wireless exists).
- Parameterization - supply organization-specific values (frequency, roles, timeframes).
- Supplementation - add controls for specific threats or technologies via overlays (cloud, OT, privacy, high-value assets).
- Compensating controls - substitute an alternative that provides equivalent protection.
Every removal, alteration, or substitution needs a written justification, an approver, and a risk assessment of what remains exposed.
Approval happens before implementation
The control set must be reviewed and approved by the appropriate authority - the system owner and authorizing official, with governance endorsement - and recorded in the security plan before build-out. Trap: treating tailoring as a purely technical decision made by the engineering team, or presenting a modified baseline at the assessment with no record of approval.
Privacy controls
Address purpose limitation, notice, consent, minimization, retention and disposal, data quality, transparency, and redress. Privacy requirements frequently exceed what security controls provide; mapping them to security controls alone is a common error.
Rule of thumb: for every control you exclude or change, you must be able to name the justification, the approver, and the compensating measure. If any of the three is missing, the control belongs in the baseline.