Information Security Handbook

Security control selection

Now that you have completed the activity of information categorization, found your organizational information assets, discovered where your organizational information is located within the information system, organized your information into discrete protection categories, and assigned a dollar value to your information you are in an excellent position to begin establishing the security controls necessary to protect your organization's information. You have worked with the business and IT teams to establish the importance of the data within your organization. You can use this information to architect the needed security controls for the information system.

Prior to establishing the security controls for your information ...