What is a common control?

• A. The security controls whose implementation is inheritable by one or more information systems
• B. A control implemented within a single system only
• C. A control assigned to external vendors
• D. A physical security check

Answer: (A)

Common controls are security controls that are implemented at the organizational level and can be inherited by multiple information systems. They’re put in place once and apply across many systems, reducing the need to duplicate controls for each system. That’s why this option best fits the idea of a common control. The other choices describe controls that are limited to a single system, or assign responsibility to external vendors, or refer to a specific physical check, none of which capture the cross-system applicability that defines common controls.