Canada ITSG-33 - IT Security Risk Management A2-3.2.1: 3.2.1 Select applicable domain security control profiles and threat assessment reports

The project selects the mandated or applicable domain security control profile and related threat assessment reports (or develops a profile if none applies) and validates four things against project documentation such as the charter: that the profile's business context, technical context, threat context and IT security approaches all apply to the system to be built; a mismatch (for example a profile for internal users reused for national or partner access, or for isolated systems reused for internet-connected ones) means tailoring is needed.