Security Control Selection Phase 2 Q4-2024

Now that we have finished classifying the system, the next step is to selected NIST recommended security controls that apply to the system’s classification (High, Moderate or Low).
NIST Publication
- FIPS 200-Minimum security requirement h t tp ://csr c .nist.g o v/publication s /fip s /fip s 200/F IP S –20 0 – fina l –ma r ch.pdf
- NIST SP 800-53 Rev4-NIST Recommended security controls (New version with the privacy family-Total of 26 families: Management, Operational, technical, and Privacy) h t tp ://n vlpub s .nist.g o v/ni s tpubs /Sp e cialP u blications /N I ST .S P .80 0-53 r 4 .pdf
SANS Top20 critical Security Control-SANS controls are mapped to NIST controls h t t p ://ww w .sa ns .o r g /critic a l –sec u ri t y –c on t r o ls
The security controls selected is termed System Security Control Baseline. This is usual in a form of a spread sheet.
The security controls (e.g., AC-2) prescribe specific security-related activities or actions to be carried out by organizations or by information systems.
The security control enhancements (e.g., AC-2 (7)) provides statements of security capability to: (i) add functionality/specificity to a control; and/or (ii) increase the strength of a control.