A small public library cannot implement every control in a full federal baseline yet still handles patron privacy data. What approach best fits asset-security practice?
Select an answer to reveal the explanation.
Short Explanation
A neighborhood library does not need a data-center bunker checklist copied line-for-line—but it also does not get a free pass on patron privacy. Scope the baseline to what you actually run, tailor thoughtfully, and write down why. Right-sized controls beat both "do everything" theater and "do nothing" hope.
Full Explanation
Scoping and tailoring adapt control baselines to organizational mission, size, technology, and risk while preserving accountability. Small entities may omit inapplicable controls with rationale, but must still protect sensitive assets appropriately. The alternative extremes—wholesale abandonment or rigid over-implementation—either leave gaps or waste resources without improving security outcomes.