Canada ITSG-33 - IT Security Risk Management A2-3.4.2: 3.4.2 Tailor security controls

The project tailors the profile's controls to the system: select applicable controls and enhancements, tailor them to the business needs, rationalise additions and removals with documented justification for the assessor and authorizer, and refine them into unambiguous statements usable by designers and in requests for proposal, setting undefined parameters. It also checks organisational policies, project-specific legal, contractual and departmental requirements, enterprise architecture standards and the domain threat report, and may use current risk information. A security requirements traceability matrix can trace needs to controls, design, threats and tests.