Module 3 Security Controls: Selecting and Tailoring
What you will be able to do
- Read a control in NIST SP 800-53: base control, enhancements, discussion, and organization-defined parameters.
- Select the baseline for a categorized system using SP 800-53B.
- Tailor a baseline and record the rationale, including assigning parameter values.
- Designate a control as common, hybrid, or system-specific and justify the choice.
- Explain the purpose of each control family in one or two sentences.
Lessons
The lessons, exercise, and quiz are for registered learners. Create a free account or sign in to read them.
- 1. Reading a Control · 35 min Completed
- 2. The Twenty Control Families · 40 min Completed
- 3. Control Baselines · 30 min Completed
- 4. Tailoring the Baseline · 45 min Completed
- 5. Common, Hybrid, and System-Specific Controls · 40 min Completed
Practice and quiz
- Practical exercise: A Tailored Baseline Excerpt for TreasuryFlow
- Module quiz (10 questions, pass mark 80 percent)
Overview
Module 2 ended with a categorization: TreasuryFlow is Moderate and holds personal information. This module turns that into a set of controls. It is the Select step of the Risk Management Framework.
You will learn to read the control catalog, find the baseline that matches the impact level, adjust it to fit the system, and decide for each control who actually performs it. The output is a tailored control set with reasons, which Module 4 turns into a written security plan.
Builds on
- Module 2, Lesson 3: the system impact level selects the baseline; the three separate ratings guide tailoring.
- Module 2, Lesson 5: the privacy determination decides whether the privacy baseline is added.
- Module 1, Lesson 3: the common control provider role.
- Module 0, Lesson 4: shared responsibility, which here becomes the common, hybrid, and system-specific designations.
Lessons
| # | Lesson | Time | Status |
|---|---|---|---|
| 1 | Reading a Control | 35 min | Adapted from existing material |
| 2 | The Twenty Control Families | 40 min | Adapted |
| 3 | Control Baselines | 30 min | Adapted |
| 4 | Tailoring the Baseline | 45 min | Adapted |
| 5 | Common, Hybrid, and System-Specific Controls | 40 min | Adapted |
What is binding here, and what is guidance
| Source cited in this module | Kind | Why it has that status |
|---|---|---|
| FIPS 200 | Binding standard | Requires minimum security requirements to be met using controls from SP 800-53 |
| OMB Circular A-130 | Binding policy | Directs agencies to apply NIST standards and guidelines |
| NIST SP 800-53 (control catalog) | Guidance, required in practice | Made applicable by FIPS 200 and Circular A-130 |
| NIST SP 800-53B (baselines and tailoring) | Guidance, required in practice | As above. The baselines are starting points; tailoring is expected |
| NIST SP 800-37 (Select step) | Guidance, required in practice | Applied through Circular A-130 |
| NIST SP 800-82 operational technology overlay | Guidance | Binding only where agency policy adopts it |
| Agency parameter defaults | Binding within the agency | A system may be stricter; looser needs a formal exception |
| The system's approved tailored control set | Binding on the system's team | It is what the authorizing official approved |
| DISA STIGs | Binding for Department of Defense systems | For civilian systems, binding only where agency policy adopts them |
| CIS Benchmarks | Not federal authority | Apply where agency policy adopts them |
| FedRAMP baselines | Binding on cloud providers seeking FedRAMP authorization | Covered in Module 8 |
Module summary
- A control has a statement, a discussion, enhancements, and parameters. Read the statement for the separate things it requires.
- An unassigned parameter makes a control untestable.
- Twenty families, each with a purpose. Program Management controls are organization-wide and sit outside the baselines. Privacy is spread across many families.
- The impact level selects a cumulative baseline; the privacy baseline is added when personal information is processed.
- A baseline is a starting point. A control is absent only if tailored out with a reason or inherited from a named provider.
- For every control, decide who does it. For hybrid controls, say exactly where the split falls. Inheritance moves the work, not the accountability.
What comes next
Module 4 takes the tailored control set and writes it up: the system security plan and implementation statements specific enough to be assessed.
Last reviewed 2026-11-11. Federal requirements, dates, and web addresses change. Before you rely on a date, deadline, or figure, open the source linked in the lesson.