Security Controls

Question 1

Name the three security Control Groups

Answer 1

Operational
Management
Technical
(privacy)

Question 2

List the management controls and identifiers

Answer 2

• Awareness and Training (AT)
• Personnel Security (PS)
• Planning (PL)
• Risk Assessment (RA)
• System and Services Acquisition (SA)

Question 3

List the Operational Controls and their identifiers

Answer 3

• Certification, Accreditation & Security Assessments (CA)
• Contingency Planning (CP)
• Incident Response (IR)
• Maintenance (MA)
• Media Protection (MP)
• Physical and Environmental Protection (PE)

Question 4

List the Technical Controls and their identifiers

Answer 4

• Access Control (AC)
• Audit and Accountability (AU)
• Configuration Management (CM)
• Identification and Authentication (IA)
• System and Communication Protection (SC)
• System and Information Integrity (SI)

Question 5

List the Privacy Controls and their identifiers

Answer 5

• Authority and Purpose (AP)
• Data Accountability, Audit and Risk Management (AR)
• Data Minimization and Retention (DM)
• Data Quality and Integrity (DI)
• Data Security (SE)
• Data Transparency (TR)
• Data Use Limitation (UL)
• Individual Participation and Redress (IP)

Question 6

What are GCA/ Common controls?

Answer 6

• Controls present in every organization
• Tend to be inherited & could come with organisation space.
• eg- CCTVS, lights, fencing, etc.

Question 7

What are System Specific Controls?

Answer 7

-Controls tunes to work specifically to meet the needs of an org. Usually put in place by management and would not be inherited.

Question 8

What are hybrid controls?

Answer 8

-Mix of common and system specific controls- tailored to meet the specific needs of an org or system.