Managing Risk in Information Systems, 3rd Edition

Identifying and Evaluating Controls

A control, also called a countermeasure, is a security control or a safeguard. A control is implemented to reduce a risk, and a risk can be reduced by reducing vulnerabilities or the impact of the threat.

When identifying and evaluating controls, the following should be considered:

• In-place controls—In-place controls are those that are currently installed in the operational system.
• Planned controls—Planned controls are those that have a specified implementation date.

In-Place and Planned Controls

Controls cost money. Before purchasing a control, an organization will evaluate its options. During its evaluation of alternative controls, the organization will gather relevant documentation. The documentation ...