A small public library cannot implement every control in a full federal baseline yet still handles patron privacy data. What approach best fits asset-security practice?
Select an answer to reveal the explanation.
Short Explanation
A neighborhood library does not need a data-center bunker checklist copied line-for-line—but it also does not get a free pass on patron privacy. Scope the baseline to what you actually run, tailor thoughtfully, and write down why. Right-sized controls beat both "do everything" theater and "do nothing" hope.
Full Explanation
A small public library that cannot implement every control in a full federal baseline yet still handles patron privacy data should scope and tailor the baseline to its environment with documented justification, rather than abandoning security or blindly over-controlling. Tailoring selects applicable controls, adjusts implementation, and records why others are not relevant—right-sized protection for catalog systems and patron records without theater. Libraries are not exempt from confidentiality duties, nor are they identical to national data centers.
Ignoring all baselines because libraries are exempt fails by concept: patron privacy and municipal systems still require security governance. Implementing every federal control verbatim even when systems and threats do not apply fails as cargo-cult compliance that wastes scarce staff on irrelevant controls. Disabling logging and access control until staffing increases fails by removing essential safeguards precisely when oversight is thin.
Exam caveat: baselines are scoped and tailored with documentation—not ignored and not copied blindly. Operational check: adopt a suitable baseline, mark controls as implemented, tailored, or not applicable with written rationale, prioritize patron privacy and access logging, and revisit the tailoring when systems change.