EM-10—Common Controls Framework

>Control Description

Organization maintains a Common Control Framework (CCF) that is used in the implementation of control measures as a risk mitigation strategy to support organization operations, technology infrastructure, and security management activities.

Theme

Process

Type

Preventive

Policy/Standard

Information Security Management Standard

>Implementation Guidance

1. Ensure that a control set is created to govern the organization's information security program. 2. Document the control set and ensure it is communicated with relevant stakeholders.

>Testing Procedure

1. Validate whether a control framework exists for managing the organization's information security program. 2. Ensure that this control set is documented and available to relevant stakeholders.