CISSP: Certified Information Systems Security Professional

Information security controls should be selected and tailored using the organization’s complete risk-management context so they are commensurate with its risks and requirements. NIST’s Risk Management Framework directs organizations to select and tailor controls based on risk assessments and relevant organizational constraints, rather than applying generic best practices or simply choosing the most stringent standard.