IT controls should be designed using identified internal and external risks as the primary input, so that control objectives and activities directly mitigate relevant threats, vulnerabilities, and potential business impacts. Industry standards, self-assessments, and expert recommendations are useful supporting inputs but do not replace risk-based control selection.
Community Discussion