Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER THREE

Expected Outputs: Controls selected for the system and the environment of operation.
Primary Responsibility: System Owner; Common Control Provider.
Supporting Roles: Authorizing Official or Authorizing Official Designated Representative; Information
Owner or Steward; Systems Security Engineer; Privacy Engineer; System Security Officer; System Privacy
Officer.
System Development Life Cycle Phase: New - Development/Acquisition.
Existing - Operations/Maintenance.
Discussion: There are two approaches that can be used for the initial selection of controls: a baseline
control selection approach, or an organization-generated control selection approach. The baseline control
selection approach uses control baselines, which are pre-defined sets of controls specifically assembled to
address the protection needs of a group, organization, or community of interest. Control baselines serve
as a starting point for the protection of individuals' privacy, information, and information systems. Federal
control baselines are provided in [SP 800-53B]. The system security categorization (see Task C-2) and the
security requirements derived from stakeholder protection needs, laws, executive orders, regulations,
policies, directives, instructions, and standards (see Task P-15) can help inform the selection of security
control baselines. A privacy risk assessment (see Task P-14) and privacy requirements derived from
stakeholder protection needs, laws, executive orders, regulations, policies, directives, instructions, and
standards (see Task P-15) can help inform the selection of privacy control baselines. Privacy programs use
security and privacy control baselines to manage the privacy risks arising from both unauthorized system
activity or behavior, as well as from authorized activities. After the pre-defined control baseline is
selected, organizations tailor the baseline in accordance with the guidance provided (see Task S-2). The
baseline control selection approach can provide consistency across a broad community of interest.
The organization-generated control selection approach differs from the baseline selection approach
because the organization does not start with a pre-defined set of controls. Rather, the organization uses
its own selection process to select controls. This may be necessary when the system is highly specialized
(e.g., a weapons system or a medical device) or has limited purpose or scope (e.g., a smart meter). In
these situations, it may be more efficient and cost-effective for an organization to select a specific set of
controls for the system (i.e., a bottom-up approach) instead of starting with a pre-defined set of controls
from a broad-based control baseline and subsequently eliminating controls through the tailoring process
(i.e., top-down approach).
In both the baseline control selection approach and organization-generated control selection approach,
organizations develop a well-defined set of security and privacy requirements using a life cycle-based
systems engineering process (e.g., [ISO 15288] and [SP 800-160 v1] as described in the RMF Prepare-
System Level step, Task P-15. This process generates a set of requirements that can be used to guide and
inform the selection of a set of controls to satisfy the requirements (whether the organization starts with
a control baseline or generates the set of controls from its own selection process). Similarly, organizations
can use the [NIST CSF] to develop Cybersecurity Framework Profiles representing a set of organization-
specific security and privacy requirements-and thus, guiding and informing control selection from [SP
800-53]. Tailoring may also be required in the organization-generated control selection approach (see