Synthesize Control Objectives

<h2>Synthesize Control Objectives</h2>

A control objective is a statement of a desired result or purpose to be achieved by implementing controls within a particular business activity. Controls are implemented through policies, organizational structures, processes, practices and procedures, and through technical systems.

A control objective can be stated in response to specific business requirements for control, or it can be a generic "good practice" statement that should be applied to all businesses.

The SABSA® Methodology uses control objectives as a means to conceptualize the mitigation strategy developed through the Business Risk Model. During the contextual security architecture phase you build a Business Risk Model as exemplified in Chapter 9, Table 9-8 (See pages 206-207). Like the Business Attributes, the control objectives are a means to take a unique real business and normalize it into common terminology and abstract concepts that can be used to drive more detailed design work, free from the confusion that unique real business detail can create.

In Table 9-8 (See pages 206-207) there were three columns to be filled in at this later stage. You now decide upon the control objectives that best express your needs for security and control and insert them into column 11 of the Business Risk Model. This is an important interface between the description of the real business (the contextual security architecture) and the description of a conceptual model of the business (the conceptual security architecture). Columns 12 and 13 of the Business Risk Model (Figure 9-8) are used to record the target vulnerability after the planned risk mitigation has been applied and the new overall risk category that results from that new reduced vulnerability level.