Control design and selection
If someone asks you in a rapid-fire round what level of control a risk practitioner should implement, the correct answer is always optimal. We have touched on this a few times in previous chapters, stating that a control should always be implemented per the risk posed by the threat and evaluated for effectiveness, efficiency, and cost before it’s implemented. There is no reason to implement a control that exceeds the cost of assets.
As we discussed earlier, these controls can be either proactive (also known as safeguards), in that they will try to prevent the incident from occurring in the first place, or they can be reactive, in that once the incident has happened, these controls will assist in detection and correction. In some cases, the risk practitioner will have the option to choose the type of control to be implemented as per the business requirements; however, regardless of the selected control, the main purpose of implementing control...
