Control Selection (Security and Privacy)

Control Selection (Security and Privacy)

When selecting security and privacy controls, an organization can use various frameworks. According to NIST SP 800-37, Revision 2, the Select Step of the Risk Management Framework, there are two approaches that can be used for the initial selection of security and privacy controls: a baseline control selection approach, or an organization-generated control selection approach.

BASELINE CONTROL SELECTION APPROACH

The baseline control selection approach uses control baselines, which are predefined sets of controls specifically assembled to address the protection needs of a group, organization, or community of interest. Control baselines serve as a starting point for the protection of individuals' privacy, information, and information systems. The baseline control selection approach can provide consistency across a broad community of interest.

ORGANIZATIONGENERATED CONTROL SELECTION APPROACH

The organization-generated control selection approach differs from the baseline selection approach because the organization does not start with a pre-defined set of controls. Rather, the organization uses its own selection process to select controls. This may be necessary when the system is highly specialized (like a weapons system or a medical device) or has limited purpose or scope (such as a smart meter).

In these situations, it may be more efficient and cost-effective for an organization to select a specific set of controls for the system (a bottom-up approach) instead of starting with a pre-defined set of controls from a broad-based control baseline and subsequently eliminating controls through the tailoring process (a top-down approach).

In both the baseline control selection approach and organization-generated control selection approach, organizations develop a well-defined set of security and privacy requirements using a lifecycle-based system engineering process (for example, ISO 15288 and NIST SP 800-160 v1).