Developing Security, Privacy, and Cybersecurity Supply Chain Risk Management Plans for Systems
Jeremy Miller2, Julie Snyder > 4.3.1. Control Tailoring

4.3.1. Control Tailoring

The control tailoring activities in [SP800-53B] provide flexibility for aligning the allocated
controls with system-specific needs, such as addressing organizational policies or specific use
cases in the system's environment of operation. Tailoring can address the impacts associated
with poor quality or counterfeit products, supplier misuse of intellectual property, supplier
tampering with or compromise of mission-critical information, and exposure to cyber attacks
through vulnerable supplier systems.
The system plans record the justification and decision for control tailoring activities, including:
• Common controls that are inherited by the system from common control providers;
• Scoping considerations for selected controls;
• Compensating controls that are selected and allocated;
19 Implementing the privacy control baseline does not necessarily mean that a federal agency has met all of its obligations under [OMB A-130].
Agencies may be required to take additional, separate actions to fully comply with OMB privacy requirements. Documenting all actions to
address privacy risk management and compliance efforts in the system privacy plan can provide essential information to support control
assessments, authorization decisions, and control monitoring processes.
20 [SP 800-161] includes specific C-SCRM instructions for selecting, tailoring, and implementing controls based on (i) the environments in which
enterprise information systems are acquired and operate; (ii) the nature of operations conducted by enterprises; (iii) the types of threats facing
enterprises, mission and business processes, supply chains, and information systems; and (iv) the type of information processed, stored, or
transmitted by information systems and the supply chain infrastructure.
• ODP values for control assignment and selection operations;
• Additional controls that supplement the baseline, such as controls based on
Cybersecurity and Privacy Framework Profiles;21
• Additional specification information for control implementation; and
• Controls that are tailored out of the selected control baseline.
Security, privacy, and supply chain risk management officials coordinate to adequately address
overlapping requirements and potential conflicts related to tailoring activities, and all decisions
are approved through the system plan approval process. However, only the authorizing official
can accept the risks associated with removing controls from the selected baseline.
Tailoring can involve enhancing existing controls to meet system-specific operational needs,
such as strengthening consent mechanisms or implementing stricter access controls for high-
risk data processing activities. Privacy officials tailor controls to address system-specific privacy
requirements (e.g., additional safeguards for health or financial data) and confirm that tailoring
decisions do not result in compliance gaps or additional privacy risks. The C-SCRM PMO can
provide input for C-SCRM plan development through tailored common controls that may apply
across the organization or mission, such as supplier risk assessments.