Tailoring of Security Baseline occurs when

• A. When ISSO and system owner identify the Common Controls, Hybrid Controls, System Specific controls and controls not applicable; after the Draft Security Control Baseline is provided to them.
• B. During system retirement.
• C. After accreditation.
• D. During procurement.

Answer: (A)

Tailoring a security control baseline means adjusting the standard set of controls to fit the actual system environment and risk. This happens during the Select phase, after the Draft Security Control Baseline is provided to the ISSO and the system owner. Together they review the draft and determine which controls are common controls (inherited by the organization), which are hybrid controls, which are system-specific, and which controls are not applicable. They document the rationale and modify the baseline accordingly. This tailoring ensures the security requirements are appropriate for the system and its operations, avoiding unnecessary controls while still preserving protection. It’s done before assessment and authorization, not during retirement, procurement, or after accreditation.