During tailoring, which controls are identified?

• A. Common Controls, Hybrid Controls, System Specific Controls, and controls not applicable.
• B. Only Common Controls.
• C. Only System Specific Controls.
• D. Only Hybrid Controls.

Answer: (A)

Tailoring determines which controls will protect the system by adjusting a baseline to fit the mission, environment, and risk. You identify four categories: Common Controls, which are shared across systems and implemented at the organizational level; System-Specific Controls, designed for this particular system’s unique needs; Hybrid Controls, a mix where some aspects are inherited and others are tailored to the system; and controls that are Not Applicable, meaning they do not apply to this system and are documented as such. This full set ensures every relevant control type is considered, while acknowledging where controls are shared, customized, or simply unnecessary.