Organizations should analyze the (initial/detailed) risk assessment and the impacts to organizational operations (that is, mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the nation, and prioritize selection of mitigation controls. Organizations should focus on mitigating risk with the greatest potential impact. Security control implementation is consistent with the organization's enterprise architecture and information security architecture.
The controls to mitigate a specific risk may vary among types of systems. For example, user authentication controls might be different for ICS than for corporate payroll systems and e-commerce systems. The ICS ...
