What best defines a hybrid security control?

• A. A control with a common portion and a system-specific portion
• B. A control that is fully common across all systems
• C. A control that is optional
• D. A fully system-specific control

Answer: (A)

A hybrid security control combines elements that are shared across the organization with elements tailored to a specific system. The best definition captures the idea that part of the control is common and applies broadly, while another part is customized to fit the particular system’s environment and needs. For example, the organization may use a standard encryption protocol across all systems (the common portion), but the way keys are generated, stored, and rotated might be specific to each system (the system-specific portion). The other options describe controls that are entirely common, entirely system-specific, or optional, none of which describe the blended nature of a hybrid control.