Identify Applicable Information Security Controls

With the regulatory frameworks and security standards selected during the strategy phase, the security program moves into the operational discipline of translating those framework selections into a specific, comprehensive, and measurable set of security controls. This transition from framework adoption to control definition is one of the most consequential steps in program execution. Frameworks establish what categories of protection the organisation must achieve. Controls define the precise mechanisms through which that protection is delivered, and the quality of their definition, the clarity of their objectives, and the rigour of their ongoing measurement determines whether the program delivers genuine security outcomes or merely the appearance of compliance.

It is important to distinguish the control objectives defined at this stage from the broader information security objectives established during the strategy phase. Strategy-level objectives describe the programme’s direction and the security outcomes it is designed to achieve at an organisational level. Control-level objectives are granular, specific, and measurable, defining precisely what each individual control is expected to accomplish, how its performance will be assessed, and who is accountable for that assessment. Both levels of objective are necessary, but they serve different governance purposes, and conflating them produces a programme that lacks the operational precision needed for continuous improvement.

Translating Framework Selections into Control Requirements #

Each framework selected during the strategy phase carries a set of control requirements that must be mapped to the organisation’s specific environment, risk profile, and operational context. This mapping exercise is the foundation of the control identification process, and it should be conducted systematically rather than assumed to follow automatically from the framework selection.

The mapping process should produce a consolidated control register that identifies every control requirement arising from the organisation’s selected frameworks, eliminates unnecessary duplication where multiple frameworks impose equivalent requirements that can be satisfied by a single control, identifies gaps where the framework requirements exceed the organisation’s current control capability, and establishes the prioritisation logic that will govern the sequence in which controls are implemented or enhanced.