the process

SELECTION AND SPECIFICATION OF SECURITY CONTROLS

T

his chapter describes the process of selecting and specifying security controls and control enhancements for organizational information systems to include: (i) selecting appropriate security control baselines; (ii) tailoring the baselines; (iii) documenting the security control selection process; and (iv) applying the control selection process to new development and legacy systems.