What is a common control?

• A. A security control that is inherited by one or more organizational Information Systems.
• B. A control that is unique to a single system.
• C. A control that is optional.
• D. A control used only for physical security.

Answer: (A)

A common control is a security control that is implemented at a higher level within the organization and is inherited by multiple information systems. Because it’s established once at the organizational or program level, several systems can share and rely on it, rather than each system creating its own separate control. This approach promotes consistency, reduces duplication, and simplifies assessment and monitoring across the enterprise. Examples include organization-wide security awareness training, a centralized incident response plan, or baseline configuration management that applies to many systems. The other ideas describe controls that are specific to a single system, optional, or limited to physical security, which do not capture the shared, cross-system nature of a common control.